Level 2 · 2B Exposed files · Lesson 2 of 2
If a file has already been exposed
Even when you're careful, it happens: a PDF with data uploaded "just for a little while", a .env file left on the server. What matters is reacting well and in order. If someone tells you they saw one of your files on the internet, take it seriously: assume it has already been copied.
The order of the response
First you plug the hole: remove the file from public access. Then you cancel whatever could have been stolen: change every key it contained. Next you measure the damage: check the logs in case someone downloaded it, and warn the affected people if it had personal data. Finally you prevent it: add a rule so it doesn't happen again.
The best defense is in the design: private things must never be in the public folder. An /admin/ page that isn't linked from anywhere is not protected: it gets discovered by trying common names. What protects it is asking for identity and permissions.
Going deeper
Why attackers find it
There are programs that crawl the internet trying typical names (.env, backup.sql, admin, phpinfo.php) on hundreds of thousands of sites a day. They don't pick you: they go through everyone. If your file is there, they find it.
Review questions
For a little while, you uploaded a PDF with customer data to the public folder. What can happen?
Answer: Someone could have downloaded it during that time. Search engines and crawler programs check nonstop. Even if it was only a short time, you have to assume it was copied.
Your site has an /admin/ page that isn't linked from anywhere. Is it protected?
Answer: No: it gets discovered by trying common names. Hiding is not protecting. What protects it is asking for identity and checking permissions.
Someone tells you they saw your .env file on the internet. What do you do first?
Answer: Remove the file from public access and change every key it had. You have to plug the hole and, above all, cancel the keys, because you assume they were already copied.