SEC-034
Docker or CI configuration is public
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/docker-compose.yml, /docker-compose.yaml, /.gitlab-ci.yml and /.travis.yml.
Why it matters
These files describe your infrastructure and often contain database passwords and deploy tokens.
Recommended fix
Keep infrastructure files out of the public folder; move any secrets in them to the platform’s secret store.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-034: Docker or CI configuration is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove the infrastructure files in the evidence from the publicly served output. If any of them contains passwords or tokens, move those to environment variables or the CI secret store and tell me which to rotate.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.