SEC-036
Site backup archive is downloadable
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
HEAD requests for /backup.zip, /site.zip, /www.zip, /website.zip and /backup.tar.gz with an archive content type.
Why it matters
A full-site backup contains the source code, configuration and often the database.
Recommended fix
Delete the archive from the server and keep backups outside the web root.
How to verify
Request each listed path and confirm 404.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-036: Site backup archive is downloadable
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Delete the backup archive(s) in the evidence from the publicly served folder, store backups somewhere private, and block *.zip / *.tar.gz in the web root if they are never meant to be public.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path and confirm 404.