.git/ | Git metadata repository | Leak of source code, history, secrets, credentials |
.env | Environment variables file | Contains DB creds, API keys, secret tokens |
.DS_Store | macOS directory index | Reveals internal directory structure |
.svn/ | Subversion version control metadata | Source code and internal file access |
.hg/ | Mercurial version control | Source code leak |
backup.zip, site.bak, db.sql | Backup files | Full site dumps, DB credentials, source code |
config.php, wp-config.php | CMS / PHP config files | DB credentials, salts, server paths |
crossdomain.xml | Flash domain policy | Unrestricted access from other domains |
robots.txt | Crawler disallow rules | Points to sensitive hidden directories |
.well-known/ | Web service policies / security.txt | Security contact or open redirect info |
.idea/, .vscode/ | IDE settings directories | Internal project structure, secrets in configs |
debug.log, error.log | Log files | Stack traces, errors, internal paths |
node_modules/ | Node.js dependencies | Outdated or vulnerable modules |
test/, staging/, dev/ | Dev environments | Often less secure than production |
phpinfo.php | PHP config file | Leak of server paths, versions, and installed modules |