.DS_Store file signature is publicly served
ShipReady found a fixed-path response beginning with the supported macOS .DS_Store file signature.
Why it matters
A served directory metadata file can reveal information worth reviewing in the deployed output.
How ShipReady detects it
What it inspects
ShipReady probes only /.DS_Store on an eligible origin response.
What triggers a finding
A finding requires HTTP 200 and the supported .DS_Store magic bytes.
What the evidence shows
The reported path returned bytes matching ShipReady's .DS_Store signature.
Limits of this check
ShipReady does not parse directory contents, enumerate files, inspect other deployment artifacts, or prove that any sensitive file is exposed.
How to fix it
Exclude macOS metadata from the release artifact
Remove .DS_Store from the served output and add it to the repository, packaging, or deployment ignore rules that control the web root.
Review how static files reach the web root
Confirm the build or hosting upload process copies only intended public files. The observed signature does not establish that other files are exposed.
How to verify the change
Recheck the metadata-file path
After deployment, request /.DS_Store and inspect the published static artifact list.
Expected: The path no longer returns bytes matching the supported .DS_Store signature.