Many breaches start with information the site gave away by accident: a .git folder, an .env file with database passwords, a backup archive, a JavaScript source map, or a detailed error page.

How it happens

Deployment processes copy more than they should, debug output is left on, and directory listing is enabled. Attackers request well-known paths such as /.git/, /.env and /backup.zip automatically.

Why it matters

• Exposure of source code, credentials and API keys.
• A detailed map of your infrastructure and internal IP addresses.
• Direct access to databases and third-party services using leaked secrets.

How to prevent it

• Deploy build artefacts only, never the working directory.
• Block access to dotfiles and backup extensions in your web server.
• Disable directory listing.
• Do not ship source maps to production, or restrict access to them.
• Show generic error pages in production.

How Vooki Pro helps

• Checks for exposed .git folders, .env files, backups, source maps, phpinfo pages and directory listings.
• Flags stack traces, verbose errors, internal IP addresses, database strings and sensitive comments in responses.
• Detects exposed API documentation such as Swagger files.
• ThreatLens, the on-device AI, also looks for exposed secrets and personal data that pattern rules can miss.

Frequently asked questions

Why is an exposed .git folder dangerous?

Attackers can download it and rebuild your source code, often including configuration and credentials.

Should source maps be public?

Usually not. Source maps reveal your original front-end code; keep them out of production or restrict access.

Related: WordPress security best practices · API keys and secrets in front-end code