A common misconfiguration.
THE PROBLEM
Many frameworks expect the web root to point at a public subdirectory inside the project.
If it points at the project root instead, configuration files become web-accessible.
WHAT THAT EXPOSES
Environment files containing database credentials and API keys Source code Dependency directories
That is a serious exposure and a common one.
HOW TO CHECK
Try loading your environment or configuration file directly in a browser.
If it downloads or displays, your document root is wrong.
HOW TO FIX IT
cPanel, Domains. Set the document root to the public directory inside your project.
WHAT ELSE TO CHECK
That dependency directories are not reachable That version control directories are not reachable
That last one exposes your entire source history.
WHAT TO DO IF SOMETHING WAS EXPOSED
Assume credentials are compromised. Change them all.
Then fix the configuration.
