Exposed file · Scan · first seen 12 Oct
HighLikelyIn progressTunde Martinsfix by 11 Nov
In progress · with Tunde
The file's blocked at nginx; the leaked database password hasn't been changed yet.
One problem in one place, found by scan.
1 source · 1 place
Scan
First found Mon 12 Oct
What closes it
Nobody can mark it fixed by hand. A person submits the fix; a scan or a retest decides it.
14th of 39 in your queue
Proof first, then exploitation in the wild, a public exploit, EPSS and severity, adjusted for exposure and how much the asset matters
Priority
56 / 100
What each source saw
As each source gives it · secrets, keys and card numbers stay masked
The scan's case file · tessellatepay.com
See it in that scanWhy it matters here
The file is readable by anyone and holds a database connection string and a Paystack key. Even on staging, credentials like these are often shared with production.
What we saw
https://staging.tessellatepay.com/.envEnvironment file is downloadable: it usually holds database and API credentials.
APP_ENV=staging APP_DEBUG=true DATABASE_URL=•••••••• PAYSTACK_SECRET_KEY=••••••••
The fix
Block dotfiles at nginx (`location ~ /\. { deny all; }`), remove the file from the web root, and rotate every credential in it.
Where
What happened, and what was said
1 event · 0 comments · oldest first
One finding belongs with this one
The same story from another source: fix them together