Security Test: Source code disclosure¶

Description¶

Default Severity: high

When a website accidentally shows its own code, attackers can see exactly how things work behind the scenes. This exposure often happens because the server isn’t set up properly to hide sensitive files, or error messages reveal too much detail. If someone can look at your source code, they might figure out how to break into your system by identifying weak spots, sensitive configurations, or hidden credentials. The risk is that an attacker can then craft more targeted attacks that can lead to bigger breaches. Developers can often overlook proper file permissions, secure error handling, or misconfigure their servers, which opens the door to this kind of vulnerability.

Reference:

• https://www.zaproxy.org/docs/alerts/41/

Configuration¶

Identifier: information_disclosure/code

Examples¶

All configuration available:

checks:
  information_disclosure/code:
    skip: false # default
    options:
      diff_threshold: 0.1 # default
      size_threshold: 200 # default
      small_response_diff_threshold: 0.4 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶