insecure-source-code-management

Detect exposed version-control artifacts and backup/config leaks during authorized recon.

1.6k|204|Updated Apr 7, 2026

Search Tags:#version-control #security-recon #authorized-testing #credential-leaks #vcs-exposure #backup-exposure

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill insecure-source-code-management

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/yaklang/hack-skills/tree/main/skills/insecure-source-code-management
Command: npx skills add https://github.com/yaklang/hack-skills --skill insecure-source-code-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.

Core Features & Use Cases

Detect exposed version-control metadata such as .git, .svn, and .hg directories, along with common backups and sensitive config artifacts.
Define safe, authorization-bound workflows for identifying leaks, reporting evidence, and guiding remediation.
Use case: During an authorized test, discover a .git/config remnant or backup.zip leaks and quickly assess risk and steps to remediate.

Quick Start

Probe common leakage points such as /.git/, /.svn/, /.hg/, and backup/config artifacts within the authorized scope.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect exposed .git or .svn directories during authorized testing?▼

Detect exposed .git or .svn directories by probing common version-control leakage points like /.git/ and /.svn/ within your authorized scope to identify remnant metadata and assess risk.

What is source code exposure and how does backup leakage occur?▼

Source code exposure occurs when version-control artifacts like .git, .hg, or backup files such as backup.zip are left accessible on live applications, allowing unauthorized retrieval of sensitive configuration and repository history.

How to safely collect evidence of VCS exposure without modifying the target?▼

Safely collect VCS exposure evidence by applying non-destructive probing techniques to read exposed configuration files, ensuring authorization-bound workflows that guide remediation without altering the target repository.

Does this approach work for finding .env and config file leaks?▼

Yes, this approach works for finding .env and config file leaks by extending detection rules beyond version-control directories to include common backup and sensitive configuration artifacts within the testing scope.

What should I do after finding exposed version-control metadata?▼

After finding exposed version-control metadata, you should collect secure evidence of the leak and follow the provided guidance on remediation to restrict access and remove the exposed artifacts from the live application.