Are API keys in HTML this module?

No. Tokens and credentials in live HTTP responses are [Scan for Exposed Secrets](/library/modules/scan-for-exposed-secrets). This module looks for files at known paths (`.env`, `.git/config`, `.aws/credentials`). A key in `index.html` is the secrets sibling. A key in `.env` is this module.

Is a 200 enough to call it a finding?

No. The module validates that the body looks like a real config, log, or artifact, because SPA catch-all indexes and custom error pages return 200 for anything. Content validation is the false-positive filter. It is not a guarantee.

Does it recover git history?

No. Finding `/.git/config` is a finding. Recovering the repository is a separate step you run yourself.

Do I need path discovery first?

Not for files at the web root. A root-only URL list still misses nested `.env` and `.git/config`. Nest this after [Discover Paths via Crawling](/library/modules/discover-paths-via-crawling) or [Discover Paths via Directory Brute Force](/library/modules/discover-paths-via-directory-brute-force) when you need that depth.

What counts as a sensitive file?

Configs, logs, VCS metadata like `/.git/config`, cloud credential files like `/.aws/credentials`, and other development artifacts left at known paths. The module validates the body looks like the real thing before it keeps the row.

Can it scan thousands of web servers in one pass?

Yes. The module runs at fleet scale off a typed URL list with content validation and recursive path-prefix checks. Scale out across machines when the URL list is large.

2026-08-13

Vulnerability Scanning

Scan for Sensitive Files

Probe known paths for .env, .git/config, logs, and dev artifacts, and validate the body looks like a real file. Cuts soft-404s across a URL fleet.

What Scan for Sensitive Files does

Sensitive files exposed on the web root are configs, logs, .git metadata, and .env files that hand credentials and source to anyone who knows the path. This module probes known paths for those files and validates the response body so a soft-404 does not become a finding. It runs across thousands of web servers in one pass.

You feed a live URL list. The module probes known paths for configs, logs, .git, .env, .aws/credentials, and other development artifacts, then validates the response body so a status code alone is not a finding. It does not hunt hostname-named backup archives, and it does not run a body-wide secret regex across HTML. Flags live on tool pages; the hard problem here is telling a real config from a soft-404.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Live URLs from Probe for Web Servers. Nested .env and .git/config need path seeds from Discover Paths via Crawling or Discover Paths via Directory Brute Force.

Downstream

findings into Generate Scan Report.

Parallel

The other exposed-artifact modules on the same URL list: Scan for Exposed Admin Panels, Scan for Exposed Backups, and Scan for Exposed Secrets. Each owns a different artifact class. Do not share one H1.

When to use this

Nest this after you have live web URLs and you want to know which known sensitive-file paths serve real content. A root-only URL list misses nested .env and .git/config; nest after path discovery for that coverage.

Inputs and outputs

Required: urls (FILE): live HTTP URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.
Optional: header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines of finding details. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, description, and (v1.2.1) the HTTP request that triggered the row. README examples: Git Configuration at /.git/config (medium) and AWS Credentials at /.aws/credentials (high).

Data

The tables this module produces. Sample rows are illustrative.

findings9 columns · 3 sample rows

Sensitive files at known paths whose response body validated as a real file.

	findingtext	locationurl	severitytext	hostnametext	domain_nametext	ip_addresstext	methodtext	descriptiontext	requesttext
1	Git Configuration	https://app.example.com/.git/config	medium	app.example.com	example.com	203.0.113.10	GET	Repository config exposed at /.git/config.	GET /.git/config HTTP/1.1
2	AWS Credentials	https://app.example.com/.aws/credentials	high	app.example.com	example.com	203.0.113.10	GET	Cloud credential file exposed at /.aws/credentials.	GET /.aws/credentials HTTP/1.1
3	Environment File	https://api.example.com/.env	high	api.example.com	example.com	198.51.100.42	GET	Application .env file served from the web root.	GET /.env HTTP/1.1

How it differs from similar modules

Scan for Exposed Admin Panels

Artifact class it owns

Management / login UI; default creds on a subset

Upstream it needs

live urls

Scan for Exposed Backups

Artifact class it owns

Hostname-named .bak/.sql/zip/tarball

Upstream it needs

live urls

Scan for Exposed Secrets

Artifact class it owns

Patterns in the response you fetched

Upstream it needs

live urls

Scan for Sensitive Files

Artifact class it owns

.env, .git/config, logs, dev artifacts

Upstream it needs

live urls

questions