Stop 31 of 42 · The Blueprints · Exposed files & risky HTTP methods

Files left in the lobby

Walking into the lobby, Mallory notices the staff left papers on the floor: a ring of passwords, a box of old backups, and an index of every file in the building. At the counter, the windows also accept strange requests like “replace this” or “destroy that.”

Severity Medium–HighCategory Info Disclosure / Auth WeaknessThe BlueprintsSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory picks up secret files left in the lobby, reads the directory listing, and sends unusual requests to a counter window that accepts them all.

Arrival

Alice walks in and goes to the counter window. Mallory follows, and notices the staff left papers lying around the public lobby.

1 / 5

In bank terms and app terms

In the bank	In your app
Papers on the lobby floor	Sensitive files served from a public folder: .env, .git, backups, config
Index of every file	Directory listing enabled on the web server
Odd requests at the window	HTTP methods like PUT, DELETE, TRACE accepted where they aren’t needed
Sign that lists accepted requests	Method allowlist per route (405 for everything else)

Are you exposed?

You might be exposed if…

Opening /.env, /.git/HEAD or /backup.zip on your site returns real file contents instead of a 404 or 403.
Your static folder shows a file list (“Index of /”) when you visit it.
Your server answers TRACE or accepts PUT and DELETE on routes that should only read.

What to do about it

Keep secrets in your host’s environment settings, not in the deployed folder. Block dotfiles (except /.well-known) and backups from being served. Rotate any secret that was ever public.
Disable directory listing and delete old backups and build leftovers from public folders.
Allow only the HTTP methods each route needs, and turn off TRACE on your web server or proxy.

Track these in your to-do list →

What it looks like in code

// GOOD: Block sensitive paths in middleware or hosting config
// vercel.json
{
  "headers": [
    { "source": "/.env", "headers": [{ "key": "x-robots-tag", "value": "noindex" }] }
  ],
  "rewrites": [
    { "source": "/.env", "destination": "/404" },
    { "source": "/.git/(.*)", "destination": "/404" }
  ]
}

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt

Check that nothing sensitive is served publicly: .env files, .git, backups, source maps with secrets. Make sure the public/static folder contains only intended assets, disable directory listing, and block dotfiles (except /.well-known) in the server config, and rotate any secret that was exposed. Add per-route HTTP method allowlists (return 405), disable TRACE, and make sure error responses do not contain stack traces. List the changes.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

WSTG: Review Old Backup and Unreferenced Files for Sensitive InformationOWASPBackups and special paths like .git/ left in public folders expose sensitive data
WSTG: HTTP MethodsOWASPPUT and DELETE can change data; TRACE echoes requests (cross-site tracing)
A05:2021 Security MisconfigurationOWASPDirectory listing left on and stack traces in errors are common misconfigurations
III. ConfigThe Twelve-Factor AppKeep secrets and credentials in the environment, not in the deployed code folder
RFC 8615: Well-Known URIsIETF/.well-known/ is the standard path prefix, so it is the exception to blocking dotfiles
405 Method Not AllowedMDN Web DocsReturn 405 with an Allow header for methods a route doesn't support

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.