Verify that the application is deployed either without any source control metadata, including the .git or .svn folders, or in a way that these folders are inaccessible both externally and to the application itself.
Verify that the application is deployed either without any source control metadata, including the .git or .svn folders, or in a way that these folders are inaccessible both externally and to the application itself.
Verify that debug modes are disabled for all components in production environments to prevent exposure of debugging features and information leakage.
Verify that debug modes are disabled for all components in production environments to prevent exposure of debugging features and information leakage.
Verify that web servers do not expose directory listings to clients unless explicitly intended.
Verify that web servers do not expose directory listings to clients unless explicitly intended.
Verify that using the HTTP TRACE method is not supported in production environments, to avoid potential information leakage.
Verify that using the HTTP TRACE method is not supported in production environments, to avoid potential information leakage.
Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.
Verify that documentation (such as for internal APIs) and monitoring endpoints are not exposed unless explicitly intended.
Verify that the application does not expose detailed version information of backend components.
Verify that the application does not expose detailed version information of backend components.
Verify that the web tier is configured to only serve files with specific file extensions to prevent unintentional information, configuration, and source code leakage.
Verify that the web tier is configured to only serve files with specific file extensions to prevent unintentional information, configuration, and source code leakage.