---
title: "Serve no hidden files · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files
updated: 2026-10-20
licence: "All rights reserved"
---

# Serve no hidden files

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)
- Rule: Serve only the files you meant to publish. Never serve version control folders, settings files, backups or folder listings.
- How: Publish a build folder, not the project folder. Block every path that starts with a dot, except `/.well-known/`. Turn off folder listings in the web server.
- Check: The agent requests common leaked files. Each one answers 404 or 403.

Example:

```text
/.git/HEAD  /.env  /config.php.bak  /backup.zip  /db.sql  /.DS_Store  /uploads/
```

```nginx
location ~ /\.(?!well-known/) { return 404; }
autoindex off;
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/no-hidden-files`.

- Previous: [Close debug and admin doors](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors)
- Next: [Return only the fields needed](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/only-needed-fields)
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets)