Common Exposed Files Panels mistakes that still ship

I still reach for curl first. That habit catches some of these. It also creates a false calm when /.env 404s and backup-final-FINAL.zip still sits two directories deeper. SlaySlop's Exposed files and admin panels check "Checks for publicly reachable env files, backups, and admin consoles." The mistakes below are the ones I see ship anyway.

Outcome if you catch these early

Public hosts stop serving env files and backup archives. Admin console reachability matches the policy you wrote down. Client-side secrets and Default credentials are tracked as siblings instead of being waved away as "the exposed files ticket."

Boundaries

Read-only observation. Permissioned scans. Not a pentest. Not a silent delete on the client's CDN. Security category siblings stay separate: headers, TLS, XSS templates, CORS, open redirects, known CVEs, default credentials, client-side secrets.

Security and secrets product framing still applies: public attack surface, ranked exposure, evidence on the finding. Your fix notes should be that boring and that specific.

Mistake 1: only testing /.env

The definition lists three families. Env files are one. Backups and admin consoles are not optional side quests.

# Permissioned — expand beyond the one path everyone remembers
curl -sI "https://www.example.com/.env" | head -n 8
curl -sI "https://www.example.com/dump.sql" | head -n 8
curl -sI "https://www.example.com/wp-admin/" | head -n 8

Mistake 2: robots.txt as access control

Disallow: /backup tells polite crawlers a preference. It does not stop a GET. I have opened enough "blocked in robots" folders that still returned 200.

Mistake 3: fixing production, leaving staging world-readable

Staging often has the richer backups. Clients still click the staging link from the handoff email. Scan the hosts you named in the SOW.

Mistake 4: renaming the admin path and calling panels done

Obscurity can be a layer. It is not a substitute for credential hygiene, and it does not remove an env file. Default credentials remains a separate check when ownership is verified.

Mistake 5: conflating Client-side secrets with this check

A Stripe key in a bundle is Client-side secrets ("Searches public bundles and responses for exposed keys and tokens"). A downloadable .env is Exposed files and admin panels. Different tickets. Different fixes. I have written "rotated secrets" on the wrong row before. It wasted a day.

Mistake 6: deleting the object without rotating

If the file was public, treat contents as burned. Rotate database passwords, API keys, and tokens referenced inside. Then rescan.

mistake: delete_without_rotate
symptom: path 404s, old DB password still valid
fix: rotate vault entries; invalidate sessions; rescan

Mistake 7: trusting one WAF screenshot

A blocked request from your laptop is not a global guarantee. Edge rules differ by path, method, and geography. Believe the scanner evidence and a second vantage point more than a single browser plug-in screenshot.

Mistake 8: soft-404 HTML with status 200

Some hosts return a branded "not found" page with 200. Curl headers look oddly fine until you read the body or content-type. Open the evidence. Do not celebrate status codes alone.

How I verify without folklore

I open the finding path, confirm status and content-type, fix at origin or edge, rotate if needed, then rescan the same host. Soft close with the glossary quote in the ticket so the next person knows the claim.

References: Exposed files and admin panels, Client-side secrets, Default credentials. A permissioned pass on SlaySlop is enough to re-check the public surface after the cleanup.

Mistake 9: one clean scan, then a migration dump

Launch is clean. A week later someone syncs a database dump into public/ "temporarily." Monitoring for uptime will not complain. Exposed files and admin panels will, if you keep scanning. Schedule the same check after migrations, not only before the party.

I keep a short post-migration note in the runbook: rescan apex and CDN hostnames, confirm no new archives, confirm admin reachability policy unchanged. Dull. Effective.