Docker Compose file signature is publicly served
ShipReady found a publicly served fixed-path response that matches a bounded Docker Compose service-definition signature.
Why it matters
A deployment configuration file can reveal service names and settings, so unintended public access deserves review.
How ShipReady detects it
What it inspects
ShipReady probes only /docker-compose.yml and /docker-compose.yaml on an eligible origin response.
What triggers a finding
A finding requires HTTP 200, no SPA catch-all signature, a services: entry, and either image: or build: content.
What the evidence shows
A matching fixed path returned content that matches ShipReady's Docker Compose signature.
Limits of this check
ShipReady does not parse the complete file, identify credentials, test services, or establish that the file contains secrets or represents the active deployment.
How to fix it
Exclude Docker Compose files from the public deployment output
Trace how docker-compose.yml or docker-compose.yaml reached the served directory, then exclude it through the build, copy, container, or hosting configuration.
Review the release artifact boundary
Keep deployment-only configuration outside the web root and confirm the release contains only files meant to be served. This finding does not establish that the Compose file contains credentials.
How to verify the change
Request both supported Compose paths
After deployment, request /docker-compose.yml and /docker-compose.yaml and inspect the published artifact list.
Expected: Neither supported Compose path returns an unintended service-definition signature.