Known AI credential-capable configuration path is publicly served
ShipReady found a supported AI-tooling credential-capable configuration path that returned non-empty, public-looking content instead of an SPA-style fallback response.
Why it matters
A publicly served deployment configuration path can reveal tooling and warrants review of whether the file was intentionally included in the published application.
How ShipReady detects it
What it inspects
ShipReady sends bounded requests to a fixed list of supported AI-tooling credential-capable configuration paths on the scanned origin.
A response must have HTTP 200 and non-empty content, and ShipReady rejects content that matches its SPA catch-all heuristic. The origin check stays silent when edge protection blocks its sensitive-path probes.
What triggers a finding
The rule triggers when one supported credential-capable path returns HTTP 200 with non-empty content that does not resemble an SPA fallback document.
What the evidence shows
The reported known path returned public, real-looking content to ShipReady's bounded probe.
Limits of this check
ShipReady does not determine whether the file contains credentials, parse or validate any credential, authenticate, inspect other deployment files, or establish that a value is secret, usable, or compromised. Unanswered, non-200, empty, fallback-like, or edge-blocked responses do not produce this finding.
How to fix it
Confirm what the published path contains
Review the exact deployed file and confirm whether it belongs in the public application output.
Publish only intended application output
Adjust deployment and static-file configuration so the reported tooling path is not publicly served when it is not intended to be public.
Review values only after confirming their presence
If the file contains confidential configuration, use the relevant owner controls to assess and replace those confirmed values.
How to verify the change
Request the reported path after deployment
Fetch the exact reported path without credentials and verify that it no longer returns the unintended configuration content.
Expected: The deployed application does not publicly serve the unintended configuration file.