Sensitive Files
Development File Exposure Check
Development files (phpinfo, .env.example, composer.json) must not be accessible in production. Learn how to identify and remove them to reduce your attack surface.
What this test checks
This test checks whether sensitive development or configuration files are publicly accessible, such as .env.example, phpinfo.php, composer.json, package.json, etc. These files reveal information about your environment, dependencies, versions, and sometimes test credentials, making attackers' jobs easier.
Our recommendation
Delete all development files from your production server. Files like phpinfo.php, .env.example, tests, or build configuration files should be excluded from deployment. Use .gitignore and deployment tools to prevent transferring them. Regularly check that these files do not reappear.
Security tests
Read more
Form Security