.git/ |
Git metadata repository |
Leak of source code, history, secrets, credentials |
.env |
Environment variables file |
Contains DB creds, API keys, secret tokens |
.DS_Store |
macOS directory index |
Reveals internal directory structure |
.svn/ |
Subversion version control metadata |
Source code and internal file access |
.hg/ |
Mercurial version control |
Source code leak |
backup.zip, site.bak, db.sql |
Backup files |
Full site dumps, DB credentials, source code |
config.php, wp-config.php |
CMS / PHP config files |
DB credentials, salts, server paths |
crossdomain.xml |
Flash domain policy |
Unrestricted access from other domains |
robots.txt |
Crawler disallow rules |
Points to sensitive hidden directories |
.well-known/ |
Web service policies / security.txt |
Security contact or open redirect info |
.idea/, .vscode/ |
IDE settings directories |
Internal project structure, secrets in configs |
debug.log, error.log |
Log files |
Stack traces, errors, internal paths |
node_modules/ |
Node.js dependencies |
Outdated or vulnerable modules |
test/, staging/, dev/ |
Dev environments |
Often less secure than production |
phpinfo.php |
PHP config file |
Leak of server paths, versions, and installed modules |