SEC-032
Log files are publicly downloadable
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/error.log, /error_log, /debug.log, /logs/error.log, /npm-debug.log and /yarn-error.log.
Why it matters
Logs reveal stack traces, file paths, environment details and sometimes tokens or customer data.
Recommended fix
Write logs outside the public folder and delete the exposed files.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-032: Log files are publicly downloadable
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Move log output outside the publicly served folder, delete the exposed log files in the evidence from the deployment, and add the log file names to .gitignore.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.