Sensitive File Exposure (sensitive-file-exposure)

Summary

HEAD probes for sensitive paths (.env, .git, backups, admin panels).

Classification

• Category: SECURITY
• Plugin id: sensitive-file-exposure
• Version: 1.0.0
• Target types: WEBSITE, WEBSHOP
• Weight class: LIGHT
• Risk level: not set on plugin object
• Browser required: No (HTTP / Node / other — see source)
• Tier / group: Tier 1 — HTTP-only

Schedule

• scheduleHints: { defaultInterval: '0 */6 * * *', priority: 4 }
• Prerequisites: None declared on this plugin.

Configurable inputs

Public keys are derived from inputSchema: z.object({ ... }) (underscore-prefixed keys are runtime-only and omitted here).

Field	Notes
timeout	Zod field in inputSchema — see source for defaults, min/max, and .describe().

Runtime / injected config

• None documented beyond standard worker context (target, config, logger, reportProgress). Underscore-prefixed keys are internal.

Checks that produce findings

These checks run inside this plugin during a single test run. They are not separate tests in the database — each becomes a Finding linked to the Run for sensitive-file-exposure.

Check	Typical severity	Why
/.env, /.git/config, /.git/HEAD, /wp-config.php, /adminer.php, /backup.sql, /dump.sql, /.env.backup exposed (HTTP 200)	CRITICAL	Direct leak of secrets, DB credentials, source history, or admin tools — often immediate breach material.
/.htaccess, /web.config, /phpinfo.php, /server-status, /debug.log exposed	WARNING	Reveals server config, stack details, or operational logs attackers use to tailor exploits.
/.DS_Store exposed	INFO	macOS metadata can leak directory names and aid reconnaissance (lower severity but still unnecessary exposure).

/.well-known/security.txt is counted in metrics only — no finding when present.

How each check works

1. Base URL — Resolves origin + '/' from target URL. Invalid URL → failed.
2. Path list — 15 fixed paths in SENSITIVE_PATHS, each with baked-in severity. Probed with HEAD via fetchTarget() (skipSsrfCheck: true, default timeout 10s).
3. Concurrency — Batches of 2 paths in parallel, 300ms delay between batches (politeness / WAF avoidance).
4. Finding rule — Only HTTP 200 on HEAD creates a finding (except /.well-known/security.txt, which sets securityTxtPresent metric only). Non-200, timeouts, and errors are silent.
5. Run outcome — failed if any CRITICAL; else warning if any finding. Score 100 − 20×CRITICAL − 10×WARNING − 3×INFO (floor 0).

Caveats and concerns

• HEAD-only, status-only — Does not read body; custom 404 pages returning 200 false-positive; soft-404 returning 403/404 false-negative.
• Fixed path list — Unlisted sensitive paths (/config.json, /api/.env) are not scanned.
• Same origin only — Does not traverse subdomains or CDN asset hosts.
• security.txt — Presence is a positive signal in metrics but absence does not create a finding.

Source

packages/test-plugins/src/plugins/sensitive-file-exposure.ts