openauditB85out of 100: openaudit's audit of itself
web.exposure

Sensitive file exposure

Probes a handful of well-known paths (/.git, /.env, server-status, phpinfo…), checks for public source maps, directory listings and verbose error pages, and for security.txt.

Engine
Built-in
Targets
URL
Areas
Security
Runs
By default, when the target applies
Network
Only the target itself

Run only this auditor

bunx openaudit https://example.com --only web.exposure

Built into openaudit; nothing to install.