lowSeverity: lowRisk ratingHow usable this gap is to an attacker. Severity sets the posture penalty: critical −40, high −20, medium −10, low −4, info −1. Higher severity means fix it sooner.Deploy config / web serverWhere it livesImplementationThis fix is applied in: Deploy config / web server. That's the surface you'll edit, DNS, response headers, or a static file.~5 minTime to fixEffortRoughly 5 minutes of hands-on work, propagation aside. Most of these are copy-paste.+4 posture+4 postureScore impactPoints this fix recovers in the ApeCyber posture score (0–100). Posture = 100 minus the severity penalty of every open finding; clearing this finding adds these points back.

Exposed .DS_Store: stop shipping Finder's file list to strangers

Keeping .DS_Store out of your deploy stops anyone from reading the filenames in your folders.

The threat

The scanner requested /.DS_Store and got a small binary file back. .DS_Store is a hidden file macOS Finder drops into every folder you open, to remember icon positions and the like. Harmless on your Mac, awkward in public: it also records the names of the files that were in that folder.

Anyone can fetch /.DS_Store, run it through a public parser (this takes seconds), and read the filenames of the directory it came from, including backups, old pages, or admin files you never linked and assumed nobody would find. From that list they simply request each file directly. It is a quiet way to turn “unlisted” into “listed.”

The exact fix

Stop shipping the file, and remove the copies already deployed.

Ignore it in git so it never gets committed:

# .gitignore
.DS_Store
**/.DS_Store

Keep it out of the deploy. Add it to your host’s ignore file too (for example .netlifyignore), or make sure it is not inside the folder you publish.

Remove any copies already committed, then redeploy so the live ones are gone:

git rm --cached -r --ignore-unmatch '**/.DS_Store'
git commit -m "Remove committed .DS_Store files"

Block dotfiles at the server as a backstop, while still allowing /.well-known/:

location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

Fix it for the whole team at once. Set a global ignore so no one commits these again: run git config --global core.excludesfile ~/.gitignore_global, then put .DS_Store inside that file.

Verify it

curl -s -o /dev/null -w '%{http_code}\n' https://yourdomain.com/.DS_Store

You want 404. A 200 that returns a small binary beginning with Bud1 means the file is still live and still listing your folder.

Proof

The ApeCyber scanner catches this with a single passive GET from the outside, touching nothing. apecyber.com ships to Netlify with .DS_Store kept out of the publish directory, so /.DS_Store returns nothing, one of the small wins that keeps it at A / 100. Removing it is a clean −4 off the posture score.