skills.rest
yaklang
yaklangOFFICIAL
Explore all skills by this author →
GitHub

insecure-source-code-management

Detect exposed version-control artifacts and backup/config leaks during authorized recon.

1.6k|204|Updated Apr 7, 2026
Search Tags:#version-control#security-recon#authorized-testing#credential-leaks#vcs-exposure#backup-exposure
One-click install
npx skills add https://github.com/yaklang/hack-skills --skill insecure-source-code-management
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/yaklang/hack-skills/tree/main/skills/insecure-source-code-management
Command: npx skills add https://github.com/yaklang/hack-skills --skill insecure-source-code-management

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.

Core Features & Use Cases

  • Detect exposed version-control metadata such as .git, .svn, and .hg directories, along with common backups and sensitive config artifacts.
  • Define safe, authorization-bound workflows for identifying leaks, reporting evidence, and guiding remediation.
  • Use case: During an authorized test, discover a .git/config remnant or backup.zip leaks and quickly assess risk and steps to remediate.

Quick Start

Probe common leakage points such as /.git/, /.svn/, /.hg/, and backup/config artifacts within the authorized scope.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect exposed .git or .svn directories during authorized testing?▼

Detect exposed .git or .svn directories by probing common version-control leakage points like /.git/ and /.svn/ within your authorized scope to identify remnant metadata and assess risk.

What is source code exposure and how does backup leakage occur?▼

Source code exposure occurs when version-control artifacts like .git, .hg, or backup files such as backup.zip are left accessible on live applications, allowing unauthorized retrieval of sensitive configuration and repository history.

How to safely collect evidence of VCS exposure without modifying the target?▼

Safely collect VCS exposure evidence by applying non-destructive probing techniques to read exposed configuration files, ensuring authorization-bound workflows that guide remediation without altering the target repository.

Does this approach work for finding .env and config file leaks?▼

Yes, this approach works for finding .env and config file leaks by extending detection rules beyond version-control directories to include common backup and sensitive configuration artifacts within the testing scope.

What should I do after finding exposed version-control metadata?▼

After finding exposed version-control metadata, you should collect secure evidence of the leak and follow the provided guidance on remediation to restrict access and remove the exposed artifacts from the live application.

Related Skills

Explore More Education & Research Skills→
guaidao2guaidao2
81

httpx

Probe live HTTP and HTTPS hosts and collect response metadata.

Community
Intermediate
langbyyilangbyyi
96

insecure-source-code-management

Detect exposed .git, .svn, .hg metadata and backup files on web applications.

Community
Intermediate
SkobynSkobyn

hunt-brute-force

Detect login brute force, OTP/2FA brute force, and credential stuffing vulnerabilities.

Community
Advanced
tamago0224tamago0224

golang-security

Identify security vulnerabilities in Go code using govulncheck and static analysis.

Community
Advanced