SEC-035
Private key file is public
CriticalDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/id_rsa, /.ssh/id_rsa, /server.key, /private.key, /privkey.pem and /key.pem.
Why it matters
A private key lets anyone impersonate your server (TLS) or log in to your machines (SSH).
Recommended fix
Remove the key from the public output and replace it: revoke the certificate or remove the SSH key everywhere it is authorised.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-035: Private key file is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove the private key file(s) in the evidence from the deployed output and the repository, add them to .gitignore, and give me the steps to revoke and replace the key (do not print it).
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.