Information Disclosure Checker

It reviews only what the crawl captured — page HTML, response headers, and discovered links — for five signals: directory listings ("Index of /"), references to paths that should never be public (.git, .env, wp-config, backups, SQL dumps, key files), exposed JavaScript source maps, framework/CMS versions advertised in a generator meta tag, and third-party scripts loaded without Subresource Integrity.

No. A reference to a path is not proof the file is actually served or readable — it is a lead to verify, not a confirmed breach. Confirm whether each path is reachable, block or remove it, and rotate any secret that was genuinely exposed. The checker cannot fetch those paths itself.

No. It is a passive, crawl-derived review of information a site reveals about itself. It makes no active or intrusive requests, does not attempt exploitation, and only reports what the shared crawl already retrieved. Absence of a signal means the crawl found nothing — not that the site is fully secure. Use a dedicated scanner or a professional test for assurance.

Shareable or browser-stored crawls can omit raw HTML. When no page retained inspectable HTML, the directory-listing, source-map, version, and Subresource-Integrity checks cannot run, so the run is marked unscored (only link-based sensitive-path detection is possible) rather than presented as a clean pass. Run a fresh lightweight crawl to complete the review.