A .DS_Store file is publicly accessible

What it is

A .DS_Store file is publicly reachable on your site. Finder on macOS creates it and stores the list of items in a folder. It reaches the server by accident when a folder is uploaded over FTP, rsync, or packed into an archive. We check that the response has the structure of a real .DS_Store, not just an HTTP 200.

Why it’s a problem

The file itself steals nothing. But it reveals the names of files and folders that are not linked anywhere and were never meant to be seen:

• backups, exports and old versions (db-dump.sql, web-old),
• internal folders and scripts,
• hints about what to try next. An attacker then looks for exactly those names.

This is a low-severity finding. It does show, though, that things which do not belong on the server get uploaded to it.

How to fix it

Delete the files on the server

find /var/www -name .DS_Store -delete

Stop them coming back

Add them to .gitignore and exclude them when uploading:

.DS_Store

rsync -av --exclude=.DS_Store ./ server:/var/www/site/

Block dot files at the server

nginx (lets only .well-known through):

location ~ /\.(?!well-known) {
    deny all;
}

Apache:

<FilesMatch "^\.DS_Store$">
    Require all denied
</FilesMatch>

Also check what the file listed. If there is a backup or an export, make sure it is not public either.

References

• nginx: location