Every check ยท Exposed files
Terraform state
What it checks
/terraform.tfstate
Why it matters
It describes the site's infrastructure, with the passwords and keys in it as plain text.
How to fix it
- Delete the file from the web root.
- Keep state in a remote backend, such as an encrypted S3 bucket, never alongside the site.
- Change every password and key it held.
Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Git repository Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users