Hackal Run
Exposed Paths Check
Check whether a short list of sensitive files and pages is reachable on your site. It's a quick, passive look at paths that are not meant to be public.
What this checks, and why it matters
Some files end up published by accident. A site or app deployment copies the whole working directory and ships the .git folder with it. An .env file lands in the web root with database credentials and API keys inside. A directory with no index page may list its contents to anyone. An admin login at a predictable path could be accessible to all.
This check requests a short, fixed list of well-known paths and reports which ones answered, so you can remove or restrict anything that should not be reachable.
The list is deliberately short and fixed. This tool does not guess file names, enumerate directories, or scan your site. A clean result means only that these particular paths were not found.
Questions
What counts as an exposed path?
A file or page that is reachable over the public web but was never meant to be, such as a .git or .env file left in the web root, a directory that lists its contents, or an admin login page at a predictable URL.
Which paths does this check look at?
This check relies on a fixed list of well-known locations, including /.git/HEAD, /.git/config, /.env, a few common admin routes, and the signs of an open directory listing. The list is intentionally small: this tool does not guess file names or enumerate directories.
Is this a full security audit?
No, just a quick request for a handful of well-known paths, meant as a sanity check when you launch a new site. A clean result means these particular paths were not found, not that nothing is exposed. Hackal's platform monitors your site's attack surface continuously and turns findings into prioritized fixes.
More Hackal Run checks
Beyond the spot-check
The quick look is just the start.
Unlike the tools on this page, the Hackal platform monitors your site's external attack surface continuously, and turns findings into prioritized, plain-English fixes.
See the platform