skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

insecure-source-code-management

Detect exposed version-control metadata and backup artifacts on web targets.

11|4|Updated Jun 7, 2026
Search Tags:#git#source-control#recon#authorized-testing#svn#mercurial#backup-leaks
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill insecure-source-code-management-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/insecure-source-code-management
Command: npx skills add https://github.com/sayseven7/frameseven --skill insecure-source-code-management-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you find exposed version-control metadata and backup files before attackers can reconstruct source code, secrets, or internal configuration.

Core Features & Use Cases

  • Git, SVN, and Mercurial exposure checks: Probe common metadata paths such as .git/HEAD, .svn/wc.db, and .hg/requires.
  • Backup and artifact discovery: Test for .env files, .DS_Store leakage, and common backup archives or config copies.
  • Recovery guidance: Use status-code clues like 403 versus 404 to prioritize file-by-file validation and safe evidence collection during authorized assessments.

Quick Start

Use this skill to check the target for exposed .git, .svn, .hg, and backup artifacts and summarize the findings for an authorized assessment.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check a web target for exposed .git directories and leaked source code?▼

Exposed .git directories are detected by probing target web paths for metadata files like .git/HEAD, .svn/wc.db, and .hg/requires. This discovers accessible version-control artifacts that could allow source code reconstruction during security assessments.

What is the best way to find leaked backup files and .env configuration on a website?▼

Finding leaked backup files and .env configurations involves testing web targets for common artifact paths and archive copies. This identifies exposed environment variables and configuration backups before attackers can exploit them.

Can I recover a partial git repository if the .git directory returns a 403 Forbidden error?▼

You can recover a partial git repository from 403-protected directories by using status-code clues to prioritize file-by-file validation. This enables targeted recovery of accessible metadata files within authorized testing scopes.

Does this source control exposure check support Mercurial and Bazaar repositories?▼

The source control exposure check supports Mercurial and Bazaar repositories by probing metadata paths such as .hg/requires and .bzr. It validates exposed version-control artifacts across multiple distributed systems for authorized assessments.

How do I safely gather evidence of source control leaks without exceeding authorized testing scope?▼

To safely gather evidence of source control leaks, perform targeted validation and file-by-file recovery of exposed metadata. This ensures evidence collection for version-control leaks without overreaching beyond the authorized assessment scope.

Related Skills

Explore More Software Engineering Skills→
chainreactorschainreactors
235

spray

Probe HTTP services and fingerprint web technologies on target hosts.

Official
Intermediate
xalgordxalgord
846

javascript-analysis

Analyze JavaScript assets to identify API endpoints, hardcoded secrets, and source maps.

Community
Intermediate
langbyyilangbyyi
96

insecure-source-code-management

Detect exposed .git, .svn, .hg metadata and backup files on web applications.

Community
Intermediate
EntroVyxEntroVyx
3

source-leak-hunt

Scan multiple domains for exposed sensitive files like .env and .git/config.

Community
Intermediate