Exposed version-control directory
A version-control metadata directory (Subversion, Mercurial, or Bazaar) is publicly served.
Why it matters
A version-control metadata directory (Subversion, Mercurial, or Bazaar) is publicly served. Like an exposed .git directory, this lets anyone reconstruct your source code and its full history — and history is the dangerous part, because any credential that was ever committed and later removed is still recoverable from it. Stop serving the directory (it only reaches production when a working checkout is deployed instead of build output), and rotate any secret that was ever committed. (The specific tool is named in the evidence.)
How ShipReady detects it
Origin-scoped: every path here is a property of the deployment, not of a document, so it is probed once against the seed. All probes run concurrently in one client, and each finding is gated on a content signature.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
A version-control metadata directory (Subversion .svn, Mercurial .hg, or Bazaar .bzr) is publicly served. Like an exposed .git directory, it lets anyone reconstruct your full source code and its history — and any credential ever committed and later removed is still recoverable from that history. Stop serving the directory: block requests to dot-directories at your web server or CDN, and fix the deploy so it publishes build output rather than a working checkout. Then rotate any secret that was ever committed to the repository, because removing it from the latest revision does not remove it from history.
Frequently asked questions
- What does "Exposed version-control directory" mean?
- A version-control metadata directory (Subversion, Mercurial, or Bazaar) is publicly served.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.