Insecure Source Code Management

Automates discovery and extraction of exposed version control directories and backup files during authorized security assessments. Walks you through probing .git, .svn, .hg, and .bzr endpoints, distinguishing between 403s that confirm presence versus 404s, then points you to the right recovery tool (git-dumper, GitTools, svn-extractor) based on what you find. Also covers .DS_Store parsing and common backup artifacts like .env files and .swp leftovers. The decision tree is practical: try .git/HEAD first, check the response pattern, route to the appropriate dumper. Treats 403-on-directory plus 200-on-specific-files as high priority, which is the right call since misconfigured deny rules often leak exactly that way.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill insecure-source-code-management --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Insecure Source Code Management

AI LOAD INSTRUCTION: This skill covers detection and recovery of exposed version-control metadata, common backup artifacts, and related misconfigurations. Use only in authorized assessments. Treat recovered credentials and URLs as sensitive; do not exfiltrate real data beyond scope. For broad discovery workflow, cross-load recon-for-sec and recon-and-methodology when those skills exist in the workspace.

0. QUICK START

High-value paths to probe first (GET or HEAD, respect rate limits):

/.git/HEAD
/.git/config
/.svn/entries
/.svn/wc.db
/.hg/requires
/.bzr/README
/.DS_Store
/.env

Routing note: quickly probe these paths first; for full recon workflow, load methodology from recon-for-sec and recon-and-methodology before deeper testing.