Sensitive Files Check: What StackShield Tests
Checks for exposed sensitive Laravel files (.git, logs, config).
What This Check Detects
Checks for exposed sensitive Laravel files (.git, logs, config).
Full Documentation
What this check looks for
StackShield requests a range of sensitive file paths directly: backup files (.env.bak, database.sql, *.zip), editor and version-control artefacts, log files, and config files that should never be web-reachable. It is checking which of these your server will serve to an anonymous request.
Why it matters
Sensitive files leak the same secrets as a live .env, often in forms people forget about. A database dump left in the web root exposes every row. A .env.bak from a hurried edit exposes credentials just as the real file would. An exposed .git directory can be reconstructed into your entire source tree, including its history and any secrets committed along the way.
These files are dangerous because they are accidental. Nobody deploys a database backup on purpose; it ends up web-reachable through a stray copy, a misconfigured root, or a deployment that swept extra files into /public.
What a failed check means
A failed check means at least one sensitive file was served over HTTP. Depending on the file, the impact ranges from schema disclosure to full credential compromise. Treat an exposed backup or .env variant as you would a live .env leak.
The fix is removing the files from any web-reachable location, adding deny rules for their extensions, and ensuring the document root points at /public so stray files in the project root are never served.
See the step-by-step remediation: how to fix this.
Related Security Checks
Is your Laravel app exposed right now?
34% of Laravel apps we scan have at least one critical issue, and most teams do not find out until something breaks. The free scan checks your live app in 60 seconds. Then StackShield re-runs every check after each deploy, so a fix you ship today does not quietly regress next week.