What the checker looks for
Files that belong in a repository, build system, or private store.
Deployment mistakes can copy environment files, version-control metadata, database dumps, configuration, debug logs, or backup archives into a public web root. SiteGuardrail makes a bounded set of same-origin requests for representative high-risk paths and checks the response for expected content before raising a finding.
A plain HTTP 200 is not enough. Many sites return the homepage for every unknown path. Content-aware checks reduce those soft-404 false positives, but every finding should still be reviewed in context.
Representative exposure
What can escape through the web root
Credentials, database URLs, internal service names, build assumptions.
Branches, remotes, file history, and material that may support source reconstruction.
Archived source, SQL data, user records, or old credentials.
Stack traces, environment names, local paths, and implementation detail.
Immediate response
Remove access first, then assume exposed secrets may have leaked.
- Remove the file from the public artefact or block it at the origin.
- Purge CDN and deployment caches; test the exact old URL from a clean session.
- Rotate credentials, tokens, signing keys, and database passwords contained in it.
- Review access logs for downloads of the affected URL.
- Fix the build/publish directory so the file cannot return on the next deployment.
- Rerun the focused checker.
Prevent a repeat
Make the deploy artefact an allowlist.
- Publish only the framework's intended output directory.
- Keep secrets in the hosting platform's protected environment store.
- Block dotfiles and backup/config extensions at the origin.
- Disable production debug pages and public logs.
- Inspect the final artefact in CI before uploading it.
Limitations
This is a bounded check, not filename brute force.
SiteGuardrail does not enumerate arbitrary filenames, bypass access controls, retrieve out-of-scope hosts, or prove that an old cached copy never existed. A clean result means no recognised exposure was found in completed coverage—not that every possible path is safe.