skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

insecure-source-code-management

Detect and recover exposed version-control metadata and backup artifacts during authorized web assessments.

5|2|Updated May 16, 2026
Search Tags:#security assessment#source control#backup artifacts#git exposure#svn wc.db#web recon
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill insecure-source-code-management-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/insecure-source-code-management
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill insecure-source-code-management-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps identify and recover exposed version-control metadata and common backup/config artifacts so you can convert confusing “hidden directory” or sensitive-file signals into actionable findings during authorized assessments.

Core Features & Use Cases

  • Detect exposed VCS endpoints: probes high-signal paths for Git, SVN, Mercurial, and Bazaar indicators to confirm exposure and scope.
  • Recover repository metadata safely: prioritizes key files (like Git config, refs, logs, objects) and SVN working-copy databases to reconstruct what was exposed.
  • Handle backup and environment leaks: checks for sensitive artifacts such as .env and typical backup extensions and uses the results to guide evidence collection.
  • Use-case fit: works when recon finds VCS paths, yields 403 for hidden directories, or reveals backup/config leaks that may contain sensitive URLs or credentials.

Quick Start

Use the insecure-source-code-management skill to probe and interpret /.git/HEAD and related VCS and backup artifact paths, then extract and triage any exposed metadata using the recommended recovery tools, while keeping all recovered secrets within the authorized scope.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I recover files from an exposed .git directory on a web server?▼

To recover exposed Git metadata, probe high-signal paths like /.git/HEAD and prioritize extracting config, refs, logs, and objects to reconstruct the repository structure safely during authorized assessments.

What should I do when a directory returns 403 but specific files are accessible?▼

When directories return 403 but specific files are accessible, perform targeted HTTP probing on known version-control and backup artifact paths to interpret status codes and identify exposed metadata leaks.

Can I extract source history and secrets from exposed SVN wc.db files?▼

Yes, you can extract exposed SVN working-copy databases by probing /.svn/ paths and recovering the wc.db file to reconstruct repository structure and identify potential credentials within authorized scope.

How does version control exposure detection handle .env and backup file leaks?▼

Version control exposure detection checks for sensitive artifacts like .env files and common backup extensions, using the results to guide evidence collection and triage of exposed URLs and credentials.

What version control systems can I detect beyond Git during web recon?▼

During web recon, you can detect exposed Git, SVN, Mercurial, and Bazaar metadata by probing their respective hidden directory paths to confirm exposure and scope for security assessments.

When should I not attempt to recover exposed repository metadata?▼

You should not attempt recovery outside authorized assessment scope, as handling recovered URLs, credentials, and source history requires safe evidence triage and strict adherence to authorized boundaries.

Related Skills

Explore More Software Engineering Skills→
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced
nrminornrminor

vcs-detect

Detect whether a project uses jj or git for version control.

Community
Basic
lNwNllNwNl
2

insecure-source-code-management

Detect exposed version-control metadata and backup artifacts during authorized security testing.

Community
Intermediate
faustellar1995faustellar1995
1

security-review

Analyze code for vulnerabilities and security misconfigurations in development workflows.

Community
Advanced