Home·Guides·What /.env, /debug, and /actuator mean
What /.env, /debug, and /actuator mean
Routelint·
A sensitive path is a URL left on the host after shipping: a debug console, an environment file, or a framework health endpoint.
The crawl follows the interface. These paths are extra GETs from a short wordlist, still inside the host you added. A 404 is the expected answer. A 200 that returns configuration, a token, or a stack trace is the finding.
On the demo shop, GET /debug and GET /actuator/env both return a database URL and a token. The stored copy replaces those values with [REDACTED_JWT] and a redacted password.