Sensitive File Exposure Check
Review FreeScan's small allowlist of safe public probes for files that should not be exposed.
Check your websiteWhy this check matters
Accidentally public configuration or repository files can reveal credentials, infrastructure details, or source history. FreeScan uses a deliberately narrow probe set.
Passing evidence
GET /.env → 404
GET /.git/config → 404Common failing evidence
GET /.env → 200 text/plainPossible false positives
- A custom 200 error page can resemble exposure unless the response body is checked.
- Security products may block the probe, which is a safe result rather than evidence of exposure.
How to fix it safely
- Remove sensitive files from the public document root.
- Block dotfiles and repository paths at the server or edge.
- Rotate any credential that may have been publicly retrievable.
How to verify the fix
- Request the flagged path without authentication and inspect the body.
- Confirm it returns a real denial or not-found response after the fix.
Related Security checks
Run the complete audit
Check this signal together with the related category evidence on the current public page.
Open the security audit tool
