snag.page

Every check ยท Exposed files

Git credentials

exposure/git-credentials

What it checks

/.git-credentials

Why it matters

The file holds a username and a password or token for a Git host.

How to fix it

  1. Delete the file from the server.
  2. Revoke each token in it at its Git host, and make a new one.
  3. Check the host's security log for what the token was used for.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users