Script-directory response matched an Index of signature
ShipReady received HTTP 200 from a discovered script directory and found a supported Index of signature in its HTML.
Why it matters
This is bounded technical evidence and should be reviewed in the context of the deployment.
How ShipReady detects it
What it inspects
ShipReady derives directories from fetched page scripts and probes the bounded directory set.
What triggers a finding
A probed directory returns HTTP 200 and its body includes a supported title or H1 Index of signature.
What the evidence shows
One discovered script directory returned the signature.
Limits of this check
ShipReady does not enumerate every directory or file, prove all listed files are sensitive, or test authorization beyond this response.
How to fix it
Disable or restrict directory indexing
Review the reported discovered directory and disable automatic directory indexing there, or require appropriate access control if the directory must remain available. Do not assume every listed file is sensitive solely from this finding.
How to verify the change
Verify the reported directory response
Request the reported directory after deployment and confirm it no longer returns the supported Index of signature to an unauthenticated request.
Expected: The observed directory no longer returns the directory-index signature.