A supported public path returned SQL-dump-like content
A supported public path returned content matching ShipReady's SQL-dump signature.
Why it matters
A publicly served database artifact can reveal information beyond what an application intends to publish. The observed content should be reviewed and removed when it is not deliberately public.
How ShipReady detects it
What it inspects
ShipReady probes only /backup.sql, /dump.sql, /database.sql, and /db.sql on the scanned origin.
What triggers a finding
A finding requires HTTP 200, non-HTML, non-SPA-fallback content with a recognised SQL signature: a CREATE TABLE, INSERT INTO, or DROP TABLE line, or a MySQL, MariaDB, or PostgreSQL dump marker.
What the evidence shows
The reported supported path returned content matching ShipReady's SQL-dump signature.
Limits of this check
ShipReady does not determine whether the content is complete, restorable, current, production data, or contains personal data, password hashes, or usable credentials. It does not follow redirects; non-200, HTML, fallback-like, unanswered, or edge-blocked responses do not trigger the rule.
How to fix it
Remove unintended database artifacts from public output
Remove the reported artifact from the served path and adjust deployment or storage configuration so backups are not web-served.
Review confirmed artifact content through the owner-controlled path
Determine what the file contained before deciding whether any data or credentials require follow-up.
How to verify the change
Request the reported path after deployment
Fetch the exact reported path without credentials.
Expected: The path no longer returns SQL-dump-like content.