Finding

A file that should not be public answers on the live site

This file usually carries configuration, keys, or repository history, and it is readable by anyone who asks for it.

Last updated September 20, 2026

Before launch · About ten minutes

Why AI-built apps get this

Debug routes, admin pages and leftover files survive because nothing links to them. Nothing needs to. Address lists are guessed thousands at a time by tools that cost nothing to run, and an admin route with no check in front of it was one of the causes of the Moltbook exposure.

What it affects

This file usually carries configuration, keys, or repository history, and it is readable by anyone who asks for it.

What the evidence line looks like

GET https://example.com/admin returned 200

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

The fix

Stop deploying this path, add it to your ignore file, and rotate anything it contained. Path: {path}.

Prompt for your coding agent

The file at {path} is publicly readable. Stop deploying it, add it to your ignore file, and rotate any credentials it contained.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

Incidents that involved this

Observed
Moltbook records exposure
An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.
2026-01
Read the incident

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.