---
title: "WEB-APA-010 Apache Serves Repository and Environment Files"
canonical: https://openvapt.com/checks/WEB-APA-010.html
html: https://openvapt.com/checks/WEB-APA-010.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-APA-010 Apache Serves Repository and Environment Files

No DirectoryMatch, FilesMatch or RedirectMatch rule denies .git, .svn, .hg or .env paths, so they are served if present under a document root.

- Domain: Web Apps
- Severity: Low
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-538, CWE-527
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 12.5.1, 14.3.3
- OWASP WSTG v4.2: WSTG-CONF-04
- NIST SP 800-53 Rev. 5: CM-7, SC-28
- Benchmark topic: Web server access to hidden files (topic only, no benchmark text)

## Why It Matters

Repository folders rebuild the source code and its history; .env files hold database passwords and application keys. Debian's default only protects .ht* files. One rule for every dot path removes the whole class, including files deployed by mistake later. The rating is Low because this is a missing safety net, not an exposure: when such a file is actually present under a document root, WEB-APP-009 and WEB-DOC-001 report it at their own higher severity, and when none is present the check passes and only notes the missing rule.

## How It Detects

Looks for a block or rule whose pattern covers dot-prefixed names: DirectoryMatch or LocationMatch with a dot pattern, FilesMatch starting with ^\. , or RedirectMatch for .git or .env. When none exists, checks each configured document root (metadata only, symlinks not followed) for a .git, .svn, .hg, .env or .env.* entry; Fails at Low when one is found and the rule is missing, Passes with a note when none is found.

## How to Fix

Add to the server configuration:  <DirectoryMatch "/\.(git|svn|hg)"> Require all denied </DirectoryMatch>  and  <FilesMatch "^\.(env|git|svn)"> Require all denied </FilesMatch> , then reload.

## How to Verify

```
curl -s -o /dev/null -w '%{http_code}' https://<site>/.git/HEAD  should print 403 or 404.
```

## Learn the Theory

- [P18 Web Server Hardening: nginx and Apache](https://openvapt.com/academy/p18.md)

## References

- [Apache HTTP Server, DirectoryMatch directive](https://httpd.apache.org/docs/2.4/mod/core.html#directorymatch)
- [OWASP WSTG-CONF-04, Review Old Backup and Unreferenced Files](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/04-Review_Old_Backup_and_Unreferenced_Files_for_Sensitive_Information/)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/serverconf.go

Run it: `openvapt scan --only WEB-APA-010`. Read it offline: `openvapt explain WEB-APA-010`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-APA-010.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.