Security Test: Exposed settings.php¶

Description¶

Default Severity: high

Developers often leave backup copies of settings files behind, which is risky because these files usually contain sensitive data like database credentials and secret keys. If an attacker gets hold of one of these backups, they can use that information to break into your systems, steal data, or cause other harm. The vulnerability comes from storing these backups in accessible locations and not cleaning them up during deployment. It's important to be mindful of what files are publicly available and to double-check that no leftover sensitive backups are sitting around.

Configuration¶

Identifier: information_disclosure/exposed_settings.php

Examples¶

All configuration available:

checks:
  information_disclosure/exposed_settings.php:
    skip: false # default

Compliance and Standards¶