Try this on your own site
before somebody else does.
Take the address
and add slash, dot git, slash HEAD.
On a surprising number of sites
the answer is not a missing page.
It is one short line of text
naming a branch.
Which means the folder
the site is served from
still has its git directory in it.
And from that directory
anyone patient
can rebuild your source code,
file by file,
with every commit,
including the one where somebody
removed the password from the config
and left it in the history.
Nobody chose to publish this.
The deploy was a copy.
Somebody pointed the web server
at the folder where the work happened,
or copied that folder to the server
with everything in it,
because copying everything
is the one instruction
that never forgets a file.
It never forgets the other files either.
The environment file
with the database password.
The copy of the config
somebody saved with a tilde on the end
before an edit.
The source maps
that turn your minified script
back into readable code.
The zip of the whole site
from before the last redesign.
None of it is linked from anywhere.
It does not need to be.
Scanners ask for these names
by the thousand, every day,
on every address that answers.
The mistake is not
a missing rule in the server config.
It is that the thing you deploy
was never defined.
It was whatever happened
to be in the folder.
So define it.
Build an artifact
from an explicit list
of what belongs in it,
and ship only that.
Everything else stays
on the machine it was made on.
Serve from a directory
that holds nothing
but the public files.
Keep secrets out of the tree entirely.
Then add a step to the pipeline
that asks the live site
for the usual suspects
after every deploy,
the git directory,
the environment file,
the backups,
and fails the release
if any of them answers.
What you meant to publish
is a decision.
What you actually published
is whatever the server will hand
to anyone who asks.
Go and ask it.
– Serguey Asael Shinder
Top comments (0)