snag.page

Every check ยท Exposed files

AWS and npm credentials

exposure/cloud-credentials

What it checks

/.aws/credentials, /.npmrc

Why it matters

The file holds a key or token that signs in to AWS or npm.

How to fix it

  1. Delete the file from the server.
  2. Revoke the key or token now (AWS IAM, or npmjs.com), and make a new one.
  3. Check what it was used for: CloudTrail for AWS, your package history for npm.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users