Exposed SQL database dump
A SQL database dump is being served to anyone who requests it.
Why it matters
A SQL database dump is being served to anyone who requests it. These files contain the full contents of your tables — user records, password hashes, tokens, and anything else you store — plus the schema needed to read them. This is a complete data breach on its own. Remove the file immediately, then treat every credential and personal record in it as compromised: rotate secrets and follow your breach-notification duties.
How ShipReady detects it
Origin-scoped: every path here is a property of the deployment, not of a document, so it is probed once against the seed. All probes run concurrently in one client, and each finding is gated on a content signature.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A SQL database dump is being served from your web root — anyone who requests the file downloads your entire database, including every user record and any password hashes or tokens in it. Treat this as a data breach: (1) remove the file from the server now; (2) rotate every credential and secret that appears in the data, and any application secret used to sign tokens; (3) assume the personal data in it is disclosed and follow your breach-notification obligations. Then prevent recurrence — never place backups or dumps in a public directory, run database backups to storage that is not web-served, and add the dump file patterns (*.sql, *.dump) to your deploy ignore rules.
Frequently asked questions
- What does "Exposed SQL database dump" mean?
- A SQL database dump is being served to anyone who requests it.
- How serious is it?
- ShipReady rates this critical. Fix before launch. On its own, this is enough to compromise the application.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.