From the 2MNY engineering team

#Misconfiguration

All security articles tagged "Misconfiguration" — vulnerability deep-dives, scanner guides and hardening checklists from the 2MNY team.

← All articles

All AI & LLM Security 1 API Security 2 Attack Surface 3 DNS Security 2 HTTP Headers 1 Monitoring 2 OWASP 4 Product Updates 6 Small Business 1 SSL/TLS 1 Supply Chain Security 2 Threat Intelligence 2 Website Security 7 WordPress Security 1

Attack Surface

Your Exposed .git Directory Is a Source-Code Fire Sale: What Attackers Actually Pull From It

Most teams treat an exposed /.git/ directory as a cosmetic misconfiguration. It is worse: with the config, index, HEAD and reflog readable, an attacker can enumerate your tracked files, your remotes, your commit timeline — and reconstruct the repository byte-for-byte offline. Here is what each file actually leaks, and how to prove (not guess) whether yours is exposed.

2MNY Admin • Oct 13, 2026 • 5 min read

Website Security

Stack Traces Are Free Reconnaissance: What Your Error Pages Teach Attackers

Every production stack trace is a miniature architecture document: framework, version, absolute file paths, class names, database driver, sometimes the query. Attackers harvest error pages on purpose. Here's what each framework's leak looks like, which debug endpoints make it worse, and how detection works without sending a single malicious payload.

2MNY Admin • Oct 13, 2026 • 4 min read

API Security

API Gateway Admin Planes: One GET Away From Total Takeover

An API gateway sits in front of everything and holds the keys to all of it: routes, upstream services, API keys, rate limits. When its admin plane answers an unauthenticated GET on a management port, attackers read your entire routing table — and on several gateways, rewrite it. Here's the 15-probe matrix we run and what each exposed plane really means.

2MNY Admin • Oct 13, 2026 • 4 min read

Attack Surface

Cloud Misconfiguration Scanning: Buckets, CI/CD Panels and Exposed Databases

Most cloud breaches start not with a clever exploit but with a misconfiguration — an open bucket, an exposed admin panel, a database bound to 0.0.0.0. Here is how to find them before attackers do.

2MNY Admin • Oct 11, 2026 • 5 min read

Put the reading to work

Run a free scan and see which of the issues we write about are live on your website right now.

Start Free Scan