AI tooling instruction or configuration file is publicly served
ShipReady found a known AI tooling file path returning non-empty content that did not resemble a single-page-app fallback document.
Why it matters
Repository instruction and configuration files can reveal internal development practices, prompts, architecture information, or deployment mistakes.
How ShipReady detects it
What it inspects
ShipReady sends bounded requests to a defined list of known AI tooling instruction and configuration paths on the target origin.
What triggers a finding
The rule triggers when a known non-credential-bearing path returns HTTP 200 with non-empty content that does not match the scanner's SPA catch-all heuristic.
What the evidence shows
The reported known AI tooling path returned real-looking public content to the scanner.
Limits of this check
ShipReady does not crawl repository files, authenticate, inspect deployment configuration, or establish that other private files are exposed. Credential-bearing AI config files use a separate finding.
How to fix it
Stop serving repository files
Configure the deployment to publish only intended build output and remove the exposed file from the served path.
Review nearby deployment paths
Check static-file rules and artifacts for other repository metadata that may have been included unintentionally.
How to verify the change
Request the exact deployed path
Fetch the reported path without credentials after deployment.
Expected: The path no longer returns the repository instruction or configuration content.