- Analyzer
- dast
- Category
- Data exposure
- Default severity
- Not encoded
- CWE
- Not encoded
- Execution
- Passive
- Authentication
- Not required
- Applicability
- url
- Availability
- stable
What it detects
Publicly reachable configuration and environment files that can disclose secrets or runtime settings.
Evidence
The requested path, HTTP response status, and a bounded response observation.
Remediation
Remove the file from the public web root, deny direct access, and rotate any disclosed credential.
Limitations
This check is limited to the applicability and evidence delivered by dast. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.
Related reference
Analyzer Registry · Findings and release decisions · Policy and confidence
Remediation guidance: Remediation and fix verification · Baselines and suppressions
Other data exposure checks