Exposed config file containing credentials
A configuration file holding credential fields (such as a password, secret, or database connection string) is publicly readable.
Why it matters
A configuration file holding credential fields (such as a password, secret, or database connection string) is publicly readable. Config files like appsettings.json or config.json belong on the server, never in the web root — anyone who reads this one gets the secrets your app runs on. Move it out of the served directory and rotate every credential it holds.
How ShipReady detects it
Origin-scoped: every path here is a property of the deployment, not of a document, so it is probed once against the seed. All probes run concurrently in one client, and each finding is gated on a content signature.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A configuration file containing credential fields (a password, secret, or database connection string) is publicly readable from your web root. Config files like appsettings.json or config.json must live on the server and never be served to browsers. Move the file out of the public/served directory, and rotate every secret it exposed — assume each value is compromised. Going forward, keep secrets in environment variables or a secrets manager rather than a committed file, and make sure your build only publishes the assets meant to be public.
Frequently asked questions
- What does "Exposed config file containing credentials" mean?
- A configuration file holding credential fields (such as a password, secret, or database connection string) is publicly readable.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.