SEC-033
Cloud or registry credentials file is public
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/.aws/credentials, /.docker/config.json, /.git-credentials, /.htpasswd, /web.config, /terraform.tfstate, /credentials.json (Google service account), /.kube/config, /.netrc, /.pgpass and /config/database.yml, each reported only when the body has that file’s own format.
Why it matters
These files hold working keys for your cloud account, container registry or Git host.
Recommended fix
Delete the file from the public output immediately and rotate every credential in it.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-033: Cloud or registry credentials file is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove the credentials file(s) in the evidence from the deployed output and the repository, add them to .gitignore, and list which keys must be rotated (do not print their values).
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.