Sensitive Laravel Files

What this check looks for

StackShield requests a range of sensitive file paths directly: backup files (.env.bak, database.sql, *.zip), editor and version-control artefacts, log files, and config files that should never be web-reachable. It is checking which of these your server will serve to an anonymous request.

Why it matters

Sensitive files leak the same secrets as a live .env, often in forms people forget about. A database dump left in the web root exposes every row. A .env.bak from a hurried edit exposes credentials just as the real file would. An exposed .git directory can be reconstructed into your entire source tree, including its history and any secrets committed along the way.

These files are dangerous because they are accidental. Nobody deploys a database backup on purpose; it ends up web-reachable through a stray copy, a misconfigured root, or a deployment that swept extra files into /public.

What a failed check means

A failed check means at least one sensitive file was served over HTTP. Depending on the file, the impact ranges from schema disclosure to full credential compromise. Treat an exposed backup or .env variant as you would a live .env leak.

The fix is removing the files from any web-reachable location, adding deny rules for their extensions, and ensuring the document root points at /public so stray files in the project root are never served.

See the step-by-step remediation: how to fix this.