0 / 13 hidden artifacts found this session. None of these are linked from the visible app (Home / About / Login). Two of them are reachable only by first opening another artifact — the exposed .git/config and the backup.zip.
⬜ robots.txt read (lists several Disallow'd paths)
⬜ sitemap.xml read (includes a forgotten URL)
⬜ Exposed .git directory (/.git/config or /.git/HEAD)
⬜ Config backup file (/config.php.bak) with secrets
⬜ Backup archive downloaded (/backup.zip)
⬜ Directory listing enabled (/uploads/)
⬜ Hidden admin panel (/admin-x7k2/) [path only in .git config]
⬜ Path from an HTML comment (/internal-preview/)
⬜ Editor swap file (/index.php.swp)
⬜ Old/dev endpoint still live (/dev/)
⬜ /.well-known/security.txt read
⬜ Secret dashboard (/staging-dashboard-9f3/) [path only in backup.zip]