Every check in this module is a single, passive HTTP request — no payloads, no injection, nothing that touches your data. It only checks whether something that should be private is currently, accidentally, publicly reachable. These are also some of the most common real-world causes of an actual breach, which is why a serious finding here overrides your overall score, not just this one module.
🌿 Beginner — Plain English explanations
Why this module can override your entire score
Most of PEKRYON's 26 modules measure quality — how well-configured something is. This one measures something more binary: is something exposed that never should have been public at all? A site can have perfect security headers, a flawless SSL setup, and a 95/100 score everywhere else, and still have its entire source code sitting in a publicly-readable .git folder. That single mistake matters more than everything else combined — which is why finding it caps your overall score at 40, with a clear banner explaining exactly why, rather than quietly averaging it into a number that would otherwise look reassuring.
What's checked
- Git repository exposed — whether
/.git/ is publicly readable. If it is, your entire source history is downloadable, not just your current code — including anything ever committed, even things later "removed."
- Backup files exposed — common patterns like
.env, wp-config.php.bak, backup.zip left reachable, often containing database credentials or API keys in plain text.
- Source maps exposed —
.map files that let anyone reconstruct your original, unminified JavaScript source from the shipped production bundle.
- Directory listing enabled — whether visiting a folder directly (with no index file) shows a raw file browser instead of a 403/404, letting anyone browse your file structure.
- Generator meta tag — a tag that directly names your CMS and its exact version, handing anyone looking for known vulnerabilities a head start.
- API documentation exposed — publicly reachable Swagger/OpenAPI/GraphQL playgrounds, which can reveal your entire internal API surface.
- TRACE method enabled — an old HTTP method that, left enabled, can be abused in cross-site tracing attacks to steal cookies/headers a browser would normally protect.
- OPTIONS method exposure — reveals which HTTP methods your server actually accepts; unexpectedly allowing
PUT/DELETE is worth a second look.
- Default server page — a "Welcome to nginx!" or similar page means the server was set up but never actually configured with real content — often a sign of an unfinished or forgotten deployment.
- Error/debug page disclosure — whether the page you're looking at right now already happens to be an exposed error or debug screen (a Django debug page, a Laravel "Whoops," a raw database error) rather than a normal response.
- Hardcoded secrets in page source — regex pattern matching against the page (including inline scripts) for known secret formats: AWS access keys, Stripe live keys, Google API keys, private key blocks, Slack tokens. Just as severe as git/backup exposure, so finding one also caps your overall score at 40.
- Admin panel discoverable — whether a login page is reachable at common paths (
/admin, /wp-admin, /administrator). Informational, not a fail on its own — plenty of sites legitimately have a reachable admin login protected by real authentication.
How to fix it
Most of these are one-line fixes in your web server config: block access to .git/, disable directory listing (autoindex off; in Nginx, Options -Indexes in Apache), remove backup files from your web root entirely rather than just renaming them, and exclude .map files from production builds. If you find a genuine exposure, treat it with urgency — these are exactly the kind of findings that get exploited automatically by bots scanning the entire internet for exactly these patterns, not just by someone specifically targeting you.