highSeverity: highRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Deploy config / web serverWhere it livesImplementationThis fix is applied in: Deploy config / web server. That's the surface you'll edit, DNS, response headers, or a static file.~10 minTime to fixEffortRoughly 10 minutes of hands-on work, propagation aside. Most of these are copy-paste.+20 posture+20 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Exposed docker-compose.yml: get your infrastructure map off the web root

Removing a web-served compose file stops it handing out your service layout and any inline secrets.

The threat

The scanner requested /docker-compose.yml and got YAML back with a services: block in it. That file is your infrastructure blueprint, and it was never meant to be web-served: it exists to build and run containers, not to be fetched by a browser.

Read top to bottom it hands over the shape of your stack: every service name, the exact container images and versions you run (so an attacker knows precisely what software to look up), published ports, volume mounts, internal hostnames, and any environment values written straight into the file. That last part is the sharp edge, because compose files often carry things like POSTGRES_PASSWORD or an API key inline.

The exact fix

Remove it from what you serve. A compose file is a deploy-time artifact. Take it out of the web root or publish directory so it is not reachable at all. On static hosts, make sure it is not inside the folder you deploy.

Keep it out of the build. Add it to your ignore files so it never lands in published output:

# .gitignore and/or .netlifyignore
docker-compose.yml
docker-compose.*.yml
compose.yml

Block the path at the server, as a backstop:

location ~ /(docker-compose|compose)\.ya?ml$ {
    deny all;
    return 404;
}

If the file had secrets inline, rotate them. Many compose files hard-code a database password or token. If yours did, treat each one as exposed: rotate it, then move it out of the file into an .env (referenced with ${VAR} or env_file:) that you never deploy to the web root.

Verify it

curl -s -o /dev/null -w '%{http_code}\n' https://yourdomain.com/docker-compose.yml

You want 404, not a 200 that returns YAML starting with version: or services:. Check compose.yml and docker-compose.prod.yml the same way.

Proof

The ApeCyber scanner confirms this with a single GET returning compose YAML, from the outside, touching nothing. apecyber.com publishes only its build output to Netlify, so infrastructure files never reach the served directory, and it grades A / 100. Pulling the file is a clean −20 off the posture score.