Leak Scan
A safe, read-only sweep that checks whether sensitive files — .env, .git, backups, data exports — are publicly reachable on a product's web surface.
Definition
A leak scan probes a fixed dictionary of sensitive paths on a product's public surface: configuration files (/.env, /.env.local, /.env.production, /.git/HEAD, /.git/config, /.DS_Store), information pages (/phpinfo.php), backups and dumps (/backup.zip, /backup.sql, /database.sql, /dump.sql), and data exports (/export.csv, /users.csv and export files under /uploads/, including the student-data export names seen on real madrasa deployments). Each probe is classified as exposed, suspect or safe from the response's status, content type and — for configuration files only — a first-bytes signature.
To avoid false alarms, responses are compared against a nonsense-path baseline: many apps return their normal page shell for every unknown path, and a shell page served at /.env is not a leaked .env. A probe is only confirmed exposed when the response genuinely matches the sensitive file's signature.
How MC Testing applies it
The scan is built to be safe against production: probes use HEAD or first-bytes only, and suspected personal-data files (any .csv, .sql or .zip) are judged on HEAD metadata alone — status, content type, content length. Their body is never read, downloaded or stored, so the scanner cannot itself become the leak.
A confirmed public exposure is the platform's most serious result: it is a P0 release blocker, it forces the readiness label to NOT READY while it remains open, and post-release monitoring repeats the sweep on schedule. The scan detects and reports; it never deletes or repairs anything on the tested product. See also Readiness Score.