How do scrapers find exposed files?

Attackers continuously scan billions of IPv4 addresses using automated HEAD requests for common paths like `/.env` and `/.git/config`.

Is this test disruptive to my server?

No. Our scanner issues lightweight, non-intrusive HEAD requests that evaluate server response headers without affecting performance.

ASSET LEAK DETECTION

Sensitive Files & Information Exposure Scout

Identify exposed .env secrets, git repositories, backup dumps, and leaked credentials.

Overview & Threat Landscape

Developers and DevOps teams inadvertently leave backup archives (`.zip`, `.sql`), `.git` folder metadata, and `.env` credentials in public web roots, giving attackers instant access to databases and cloud APIs.

Why Public Leaks are Fatal

Complete Database Compromise

Exposed `.env` files contain live database passwords, Stripe keys, AWS tokens, and SMTP credentials.

Source Code Exfiltration

Public `.git` directories allow automated scrapers to reconstruct your entire intellectual property and commit history.

Regulatory Penalties (GDPR/LGPD)

Exposing personal data through unattended backup files triggers severe statutory fines and liability.

Web Server Blocking Rule

Block all hidden dotfiles and backup extensions directly in your web server or Cloudflare WAF:

location ~ /\.(env|git|svn|htaccess) {
    deny all;
    return 404;
}
location ~* \.(bak|config|sql|tar|zip|gz)$ {
    deny all;
    return 404;
}