Exposed files and configuration leaks: a field guide
A practical guide to the most common exposure findings VibeLeak surfaces, with specific remediation steps for each file type.
Environment
.env files are the single most dangerous exposure
A public .env file often contains database URLs, API keys, and secrets. If it is reachable without authentication, assume it has been read.
Immediate action
- Block .env, .env.local, .env.production, and similar files at the web server level.
- Add them to .gitignore if they were accidentally committed.
- Rotate all keys and tokens that appeared in the exposed file.
Version control
A public .git folder is a source code leak
The .git folder contains the entire project history. Attackers can reconstruct the repository, read deleted secrets, and map the application structure.
Quick fix
Archives
Backup files and archives should never be public
.zip, .tar.gz, .sql, and .bak files are often left behind during deployments. They may contain full database dumps or source snapshots.
- Search the public root for any archive or backup file extensions.
- Remove them from the server entirely, not just from the index.
- Add deployment checks that fail the build if archives are present.
Packages
.npmrc and similar config files expose registry credentials
Package manager config files sometimes contain auth tokens for private registries. Exposing them gives attackers access to your internal packages.
Fix
Cloud
Cloud provider config files reveal infrastructure details
Files like firebase.json, aws-config, or supabase config expose project IDs, regions, and sometimes keys. These are valuable reconnaissance targets.
- Audit the public root for any cloud provider config files.
- Move configuration into environment variables or secure config services.
- Review cloud console access logs for unusual activity.
Remediation
The cleanup process should be systematic
Fixing exposures is not just about deleting files. It is about confirming what was exposed, rotating affected secrets, and preventing recurrence.
Identify everything exposed
Use the VibeLeak findings list to catalog every public file and its contents.
Rotate all affected secrets
Assume any key, token, or credential in an exposed file is compromised.
Block access at the server level
Add rules to nginx, Apache, or your CDN that prevent public access to sensitive paths.
Add pre-deployment checks
Fail the build if scans detect exposed files before code reaches production.
Next action
Run the scanner against your own site
The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.
Continue reading
More field notes
Workflow
Can Hermes Agent Audit a Live Website? Testing VibeLeak MCP End to End
Connect Hermes Agent to VibeLeak MCP, audit a live website, inspect the security boundary, and export agent-ready remediation evidence.
Open articleSecurity
GPT-5.6 Sol + Codex Security: Scan Outside, Fix Inside
Turn a VibeLeak public-surface scan into a structured security handoff for Codex Security and GPT-5.6 Sol to validate and patch.
Open articleWorkflow
AI agents are checking your website now. Here is the VibeSignal readiness checklist
Search is becoming conversational, agentic, and more selective about what it can understand. This is the practical checklist for making your public website easier for AI agents to find, read, use, and verify.
Open article