---
title: "HOST-SEC-001 Secrets in World-Readable Files"
canonical: https://openvapt.com/checks/HOST-SEC-001.html
html: https://openvapt.com/checks/HOST-SEC-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SEC-001 Secrets in World-Readable Files

Looks inside world-readable configuration files under /etc and the web roots for private keys, cloud access keys and password assignments.

- Domain: Server
- Severity: High
- Control category: Information Exposure
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-312, CWE-732, CWE-798
- OWASP Top 10 2021: A02:2021, A05:2021
- NIST SP 800-53 Rev. 5: IA-5, SC-28, AC-3
- Benchmark topic: Protect credentials and keys at rest (topic only, no benchmark text)

## Why It Matters

A password or key in a file every local account can read is available to every website, service account and compromised process on the machine. Secrets found this way are the usual first step from a small web compromise to the database, the cloud account or root.

## How It Detects

Walks /etc and each web document root (metadata only, symlinks not followed), picks regular files that are readable by others and have a configuration-like name (.env*, *.conf, *.ini, *.yml, *.json, *.pem, *.key, id_*, up to 300 files of at most 256 KiB), reads them without following symlinks and matches private key headers, AWS access key ids and credential assignments (password, secret, API key or token settings with a literal value). The report names the file and the kind of match only; values are never copied.

## How to Fix

chmod o-r each listed file (640 with the service's group, or 600). Move secrets into root-only files, systemd credentials or a secrets manager, and rotate every key or password that was readable.

## How to Verify

```
find /etc /var/www -type f -perm -0004 -name '.env*' -o -type f -perm -0004 -name '*.key'  then re-run this check.
```

## Learn the Theory

- [P20 Secrets, Cron and Account Hygiene](https://openvapt.com/academy/p20.md)

## References

- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)
- [NIST SP 800-53 Rev. 5, IA-5 Authenticator Management](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/hygiene.go

Run it: `openvapt scan --only HOST-SEC-001`. Read it offline: `openvapt explain HOST-SEC-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SEC-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.