Exposure Check

Looks for the classic self-hoster accidents: files and directories that end up in the web root by mistake and have no business being there. Almost every hit is a real security incident.

Verified domains only

This check deliberately requests potentially confidential paths. You may only do that on your own domain verified in the workspace. For unverified domains the check only returns a notice and performs no scan.

Check	What is checked
Version control (.git)	Is /.git/HEAD or /.git/config publicly reachable? An open .git/ exposes the entire source code incl. history (and thus often old secrets).
Environment files (.env)	Are /.env, /.env.local or /.env.production retrievable? They almost always contain database passwords and API keys in plaintext.
Backups & databases	SQL dumps (backup.sql, dump.sql), archives (.zip, .tar.gz) and SQLite files in the web root.
Config & meta files	.htpasswd, config.php.bak, .DS_Store and similar telltale files.
Admin panels & listings	Publicly reachable phpMyAdmin, Traefik dashboard or directory listings (as a warning).

Content confirmation instead of status code

A hit only counts if the actual content matches the expected signature (e.g. [core] in a git config, KEY=VALUE in a .env, ZIP magic bytes in an archive). A generic 404 or single-page-app page that answers every path with HTTP 200 is not falsely treated as a finding. Found content is not stored — only status code, size and a short, neutralized signature snippet.

Rule of thumb

Most findings occur because the entire project directory is deployed instead of just the build output. Let CI/CD build and ship only the result (dist/, build/, public/) to the server — never the repository itself. The explain mode contains ready-made nginx/Apache/Traefik rules.