Exposure Scan — Files and Endpoints You Are Serving by Accident
This probes a web host for the specific paths that should never be publicly readable: environment files holding credentials, version control directories, database dumps, administrative interfaces, debug endpoints and status pages. It is a targeted check for known-dangerous locations rather than a general crawl.
Why run it
Because these are catastrophic and common in equal measure. An exposed environment file typically contains database credentials and API keys in plain text; an exposed version control directory can allow the entire source tree to be reconstructed, including whatever secrets were committed and later removed. They appear through ordinary mistakes — a deployment that copies the working directory, a web server whose document root is one level too high, a debug mode left enabled after an investigation. Automated scanners look for exactly these paths constantly, so the only question is who finds yours first.
Why automate it
Exposure is introduced by deployments, and deployments happen continuously. A single misconfigured release can expose a directory that was correctly protected for years, and the window between exposure and discovery by someone else is measured in hours given how heavily these paths are probed. Scanning after every deployment, or on a schedule frequent enough to approximate that, is the difference between finding it yourself and finding out from a third party.
What it gives you
Detection for the mistakes with the shortest path from error to compromise. Credentials in an exposed file are not a vulnerability to be prioritised — they are an incident already in progress.