Data and secrets Required

Serve no hidden files

Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Publish a build folder, not the project folder. Block every path that starts with a dot, except /.well-known/. Turn off folder listings in the web server.

Example

/.git/HEAD  /.env  /config.php.bak  /backup.zip  /db.sql  /.DS_Store  /uploads/

location ~ /\.(?!well-known/) { return 404; }
autoindex off;

How to check

The agent requests common leaked files. Each one answers 404 or 403.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files.