SEC-024
Directory listing is enabled
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
Common folders (/uploads/, /images/, /assets/, /static/, /files/, /backup/, /ftp/, /public/) for an automatic file listing.
Why it matters
Anyone can browse every file in the folder, including uploads, old builds and backups that were never linked.
Recommended fix
Turn off automatic directory indexes on the web server (autoindex off; Options -Indexes).
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-024: Directory listing is enabled
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Disable automatic directory listings on the web server or hosting config for the folders in the evidence, and make sure those folders return 403 or 404 when requested without a file name.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.