Agent skill · security · jeremylongshore
detecting-exposed-secrets-files
Probe a target for accidentally-served secret-bearing files in the web root — .git/, .env, .DS_Store, backup files, database dumps, key files, CI configs, IDE configs. Use when: post-deploy verification on a new release, or SOC2 auditor asked "what's reachable in the web root that shouldn't be," or a bug-bounty report hints at a leaked file. Threshold: any of the canonical 40+ paths returns 200 OR returns a body matching the expected fingerprint of the file type (e.g., .git/HEAD returns content starting with ref: or a 40-char hex SHA). Trigger with: "check exposed files", "git directory exposure", "env file leak", "backup file scan".
Why this skill is useful
Adds an executable Python script for probing exposed secrets that provides immediate security insights not covered by generic practices.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Exposed Secrets Files Overview The single highest-value pentest probe per HTTP request. A .git/config disclosure leaks repo URL + credentials embedded in remote URLs. A .env disclosure leaks every API key the app has. A backup.sql disclosure leaks the entire database. These are not "weak crypto" findings that need a chained exploit. They are direct, immediate compromise. The probe set is the canonical 40+ paths web servers commonly expose by accident: VCS directories (.git/, .svn/, .hg/), dotenv files, OS metadata (.DSStore), database dumps, archive files, IDE configs, CI configs, and key files. Each is fingerprinted to distinguish a true positive (server returns the file's expected content) from a 200 OK that's actually the application's SPA index page catching the route. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- .git/HEAD reachable + valid content CRITICAL 200 + body matches ref: or 40-char SHA NIST 800-53 SC-28 .git/config reachable + repo URL leaked CRITICAL 200 + body matches [remote NIST 800-53 SC-28 .env reachable + dotenv format CRITICAL 200 + body matches KEY=VALUE lines OWASP A05:2021 .sql / .dump / backup. reachable CRITICAL 200 + body looks like SQL or binary dump CWE-538 .aws/credentials reachable CRITICAL 200 + body matches [default]\nawsaccesskeyid CWE-200 idrsa / .pem / .key reachable CRITICAL 200 + body matches BEGIN PRIVATE KEY or BEGIN RSA CWE-321 .svn/entries / .hg/store/ reachable HIGH 200 + body matches VCS format NIST 800-53 SC-28 .DSStore reachable MEDIUM 200 + binary blob with Bud1 magic CWE-538 IDE configs (.idea/, .vscode/) reachable LOW 200 + JSON/XML CWE-200 composer.json / package.json reachable on prod LOW 200 + valid JSON in non-API root CWE-200 Prerequisites Python 3.9+ with requests library Authorization for non-local targets Instructions Step 1 — Confirm Authorization Step 2 — Run the scanner Options: The scanner sends a GET for each path in the canonical probe set. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-exposed-secrets-files