SEC-037
Subversion or Mercurial metadata is public
HighDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/.svn/entries, /.svn/wc.db and /.hg/requires.
Why it matters
Version-control metadata lets anyone download the source code and its history.
Recommended fix
Remove the .svn / .hg folder from the deployed files and block dot-folders on the server.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-037: Subversion or Mercurial metadata is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Remove the .svn or .hg metadata folders from the deployed site and add a server rule that returns 404 for any path starting with a dot-folder.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.