The common private files did not answer

Debug routes, admin pages and leftover files survive because nothing links to them. Nothing needs to. Address lists are guessed thousands at a time by tools that cost nothing to run, and an admin route with no check in front of it was one of the causes of the Moltbook exposure.

Requests for configuration and repository files came back empty or missing.

GET https://example.com/admin returned 200

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Nothing to change here.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Observed

  Moltbook records exposure

  An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.

  2026-01

  Read the incident

• exposed path
• observed
• evidence