Sensitive server files are publicly accessible

What does this mean?

A handful of well-known file paths — a .env file (environment variables, often including database passwords or API keys), an exposed .git directory (which can let someone reconstruct your entire source code history), or an old backup file left behind by an editor or deploy script — were found reachable directly over the public internet. These files were never meant to be served to visitors; their presence usually means a web server is pointed at the wrong root directory, or a deploy process left something behind it shouldn't have.

What are the potential impacts?

• A publicly reachable .env file routinely contains database credentials, third-party API keys, and session secrets — enough for an attacker to directly access backend systems without needing to find any other vulnerability.
• An exposed .git directory lets an attacker download your site's entire source code and commit history, including any secrets that were ever committed even if later removed from the latest version.
• Backup files (.bak, .old, tar/zip archives left in a web root) often contain a full, older copy of the application — sometimes with weaker security than the current version, or with credentials that were rotated everywhere except that forgotten file.