---
title: "WEB-DOC-001 Secrets or Backups Stored Inside a Web Root"
canonical: https://openvapt.com/checks/WEB-DOC-001.html
html: https://openvapt.com/checks/WEB-DOC-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# WEB-DOC-001 Secrets or Backups Stored Inside a Web Root

Looks on disk inside each web document root for environment files, database dumps, backups, archives and private keys.

- Domain: Web Apps
- Severity: High
- Control category: Information Exposure
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-530, CWE-538, CWE-312
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 12.5.1
- OWASP WSTG v4.2: WSTG-CONF-04
- NIST SP 800-53 Rev. 5: SC-28, CM-6

## Why It Matters

Anything inside a document root may be downloadable, now or after a configuration change. Dumps, backups and keys there are a leading cause of data breaches; finding them on disk catches files the URL checks cannot guess.

## How It Detects

Reads document roots from the local Apache, nginx and LiteSpeed configuration, walks each one (metadata only, up to 50000 files, symlinks not followed) and matches file names such as .env, *.sql, *.bak, backup*.tar.gz, id_rsa, *key*.pem and *.key. File contents are never read. Plain archives and certificates (*.tar.gz, *.pem) are reviewed separately at Medium by WEB-DOC-003, because they are often published on purpose.

## How to Fix

Move each listed file outside the document root (for example to a 700 folder in the account's home), delete what is not needed, and rotate any secret or key that was exposed. Keep backups in a dedicated location outside every web root.

## How to Verify

```
Re-run this check; no files should be listed.
```

## Learn the Theory

- [P6 Information Exposure and Misconfiguration](https://openvapt.com/academy/p6.md)

## References

- [OWASP WSTG-CONF-04, Review Old Backup and Unreferenced Files for Sensitive Information](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/04-Review_Old_Backup_and_Unreferenced_Files_for_Sensitive_Information/)
- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/web/docroot.go

Run it: `openvapt scan --only WEB-DOC-001`. Read it offline: `openvapt explain WEB-DOC-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/WEB-DOC-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.