Independent security research

Found by me,
before the wrong people find it.

I'm Adam — a security researcher who locates exposed systems, leaked credentials, and misconfigurations on the open web, then quietly tells the owners how to fix them. No exploitation. No ransom. Just a heads-up.

100%Responsible disclosure
0Data ever sold
0Findings exploited
~/whitewebsecurity — disclosure.log
# a typical, boring day
scan> found public .env on acme-corp.example
check> DB creds, SMTP keys, JWT secret — live
action> do NOT touch. do NOT download.
notify> locate security contact
sent> responsible disclosure → security@acme
# 36h later
reply> "rotated everything. thank you."
scan>  
Who is Adam

A friendly stranger who read your config file.

Most exposed secrets aren't discovered by hackers first — they're discovered by whoever happens to look. I make sure that's someone on your side.

Adam is an independent security researcher working under the name White Web Security. The work is simple to describe and uncomfortable to ignore: scanning the public internet for the things that should never be public — exposed environment files, open .git directories, leaked database dumps, misconfigured servers and forgotten backups.

When something turns up, nothing gets touched, downloaded, or sold. The finding is documented, the owner is located, and a clear report goes out under responsible disclosure — with enough detail to fix it and nothing more. The goal is never the credentials. It's the email that says "we rotated everything, thank you."

// profile

alias
Adam · White Web Security
role
Independent security researcher
focus
Exposed secrets & misconfigurations
method
Read-only recon, zero exploitation
ethics
Responsible disclosure, always
cost
Free — coffee optional
.env leaks .git exposure open FTP credential rotation log review OSINT
Field guides

Got a heads-up? Start here.

Plain-English playbooks for the moment you realise something sensitive is public. Don't panic — work the checklist.

.env

My .env file got exposed. What should I do?

Database passwords, API keys, JWT secrets — assume all of them are now public. Here's how to rotate fast and check what was reached.

Open guide
.git/config

My .git/config file got exposed. What should I do?

An open .git folder can leak your whole source history — and the secrets committed into it. Here's how to close it and assess the damage.

Open guide
sftp.json

My sftp.json file got exposed. What should I do?

This file stores your SFTP host and password in plain text — often root. Assume the box is compromised and move fast: rotate, lock down, read the logs.

Open guide
MySQL :3306

My MySQL database got exposed without authentication. What should I do?

An open MySQL on port 3306 lets anyone read or wipe your data — and ransom bots love it. Close it, rotate, recover from backups.

Open guide
MongoDB :27017

My MongoDB database got exposed without authentication. What should I do?

The classic ransom target: open Mongo gets its databases dropped and replaced with a note. Lock it down and recover from backups — don’t pay.

Open guide
Elasticsearch :9200

My Elasticsearch index got exposed without authentication. What should I do?

An open cluster on :9200 dumps every indexed log and record in one request. Secure it, then assume it was scraped.

Open guide
Registry :5000

My private Docker Registry is publicly accessible. What should I do?

No auth means anyone can pull your private images — source code and baked-in secrets included. Close it and rotate.

Open guide
VNC :5900

My VNC server is accessible without a password. What should I do?

A passwordless VNC is your live desktop, open to the world. Cut its access now and treat the machine as compromised.

Open guide
NFS :2049

My NFS server is exposing directories to the public internet. What should I do?

A world export lets anyone mount your shares and read the files. Restrict the exports and firewall NFS.

Open guide
RabbitMQ :5672

My RabbitMQ broker is accessible with default credentials. What should I do?

guest/guest on an exposed broker means anyone can read and inject messages. Disable the default user and rotate.

Open guide
/actuator

My Spring Boot Actuator endpoints are publicly exposed. What should I do?

Public /actuator leaks your config via env and live secrets via heapdump. Restrict it and rotate everything.

Open guide
Firebird :3050

My Firebird database is accessible with default credentials (SYSDBA/masterkey). What should I do?

SYSDBA / masterkey unchanged on an open server is full admin for anyone. Change it and firewall port 3050.

Open guide
wp-config.php

My wp-config.php got exposed. What should I do?

WordPress's config holds DB credentials and secret keys in plain text. Move it above the web root and rotate everything.

Open guide
.git/index

My .git/index file got exposed. What should I do?

The index lists every tracked file with SHA hashes — git-dumper can use it to reconstruct your entire source code without a token.

Open guide
.swp / .swo

My Vim swap file got exposed with credentials. What should I do?

Editors create swap files automatically. If one landed in your web root, it may contain passwords from the file you were editing.

Open guide
id_rsa / id_ed25519

My SSH private key got exposed. What should I do?

A public private key means anyone can log into every server where it's authorised — no password needed. Revoke it everywhere, immediately.

Open guide
backup.sql

My SQL database dump got exposed. What should I do?

A public dump means your entire database — every record, user, and potentially hashed password — is downloadable. Remove it and assess the damage.

Open guide
terraform.tfstate

My Terraform state file got exposed. What should I do?

Terraform stores AWS keys, DB passwords and service account credentials in plain text inside .tfstate. Rotate every cloud credential immediately.

Open guide
serviceAccountKey.json

My cloud credentials file got exposed. What should I do?

Exposed GCP/AWS/Firebase credentials mean an attacker can make API calls as your service account. Revoke and regenerate before they do anything with it.

Open guide
appsettings.json

My appsettings.json got exposed. What should I do?

.NET's config file holds connection strings, API keys and secrets. Rotate everything inside it and move secrets to environment variables.

Open guide
application.properties

My Spring Boot application.properties got exposed. What should I do?

Spring Boot's config contains datasource passwords and API credentials. Rotate them and use Spring profiles properly to keep secrets out of the web root.

Open guide
config.php

My PHP configuration file got exposed. What should I do?

PHP config files hold database credentials in plain text. Change the DB password and move the file outside the web root.

Open guide
settings.py

My Django settings file got exposed. What should I do?

Django's SECRET_KEY and database passwords were public. Rotate the SECRET_KEY (it invalidates all sessions) and the DB password immediately.

Open guide
web.config

My web.config got exposed. What should I do?

IIS's web.config can contain database connection strings and encryption keys. Rotate credentials and move secrets to environment variables.

Open guide
.travis.yml / Jenkinsfile

My CI/CD configuration got exposed with credentials. What should I do?

Plain-text tokens or API keys in CI config are now public. Revoke them in every provider and switch to encrypted environment variables.

Open guide
.docker/config.json

My Docker registry credentials got exposed. What should I do?

Docker's auth config holds base64-encoded registry tokens. Revoke them in your registry and use a credential helper instead of storing tokens in files.

Open guide
.htpasswd

My .htpasswd file got exposed. What should I do?

Hashed passwords are offline-crackable. Move the file outside the web root and reset all protected-area passwords.

Open guide
secrets.json / .npmrc

My secrets file got exposed. What should I do?

Generic credential files (secrets.json, auth.json, .npmrc) may hold API tokens and access keys. Identify what's inside, revoke each one, and regenerate.

Open guide
CLAUDE.md / .cursorrules

My AI tool config file got exposed. What should I do?

AI coding assistant configs often contain system prompts with internal architecture details, business logic, and sometimes API keys. Find out what was exposed and lock it down.

Open guide
.netrc

My .netrc file got exposed. What should I do?

The .netrc file stores plaintext passwords for FTP, SFTP, HTTP and Git hosts. An exposure means every listed service is immediately accessible to anyone who read it.

Open guide
docker-compose.yml

My docker-compose.yml got exposed. What should I do?

Compose files routinely contain database passwords, API keys and SMTP credentials in plain text inside environment: blocks. Rotate everything and move secrets out of the file.

Open guide
/storage/logs/laravel.log

My Laravel log file is publicly accessible. What should I do?

Laravel error logs contain database DSNs and API keys that spill into exception messages. Block the path, rotate every credential in the log, and set APP_DEBUG=false in production.

Open guide
The promise

How responsible disclosure works here.

No surprises, no pressure, no fee. Every report follows the same predictable path — and you stay in control of the fix.

Discover, never exploit

Findings come from read-only observation of what's already public. Nothing is accessed beyond what proves the issue exists.

Document privately

The exposure, its location, and its impact are written up clearly — kept confidential between you and me.

Reach the right person

I find your security contact and send the report directly, with everything you need to verify and remediate.

You fix, on your timeline

Rotate secrets, close the hole, review your logs. I'm available for questions and will never publish without your say-so.

This work is free. Coffee keeps it going. ☕

If a heads-up ever saved you a very bad week, you can say thanks.

Buy me a coffee