Exposed files

The header check passed. The .env file didn't know that.

Every other Canopy check reads what your site means to send. This one hunts for what it doesn't — a public .git, a readable .env, a database dump or a phpinfo() left in the web root — confirmed by the file's own contents, so a catch-all 404 never triggers a false alarm.

Try: github.com · cloudflare.com  |  Security headers → · security.txt →

Scan sites you own or are authorised to test. Canopy sends only ordinary, non-destructive GET requests to well-known paths — the same ones a bad actor would try first.