Platform / Data Exposure

Find exposed files, backups and secrets on your public website

Many real-world leaks are not hacks. A forgotten .env file, a database backup left in a web folder or an open directory listing is simply reachable by anyone who asks. PixelPrivate is adding safe checks for exactly these public exposures.

Start 14-day free trial Run a free check

Find the files you never meant to publish before someone else does.

Data ExposureHonest status

Who it is for

Built for teams without a security department

Teams whose website is built from a repository or deployed by hand, where stray files easily end up in the web root.
Agencies that inherit client sites and need to confirm nothing sensitive is lying around.
Founders and operators who want to know that credentials and customer data are not one URL away from the public.

Business outcomes

The business problem: a single forgotten file can become a breach notice

Avoid breach costs that started with a typo

An exposed environment file can contain database passwords and API keys. If those are abused, the bill includes incident response, customer notification and possible regulatory exposure, all from a file that should never have been public.

Stop leaking your own source and structure

A reachable .git folder can let a stranger reconstruct your source code and history, which can reveal credentials committed long ago and make targeted attacks easier.

Reduce fraud and downtime risk

Leaked keys for payment, email or hosting services lead directly to fraud, spam from your account or a site taken offline.

Give customers a straight answer

Questionnaires ask whether sensitive files and backups are kept off the public internet. A dated check gives you something concrete to point to.

What you get

Capabilities and where each one stands today

Every item carries a status. Available means it is built and working today. New means it is being added now. Roadmap means planned and not yet built.

AvailableNewRoadmap

Exposed .env and configuration file checks

New

Checks whether common environment and configuration file paths respond on your public site.

Exposed .git directory check

New

Detects whether version-control metadata is reachable from the web.

Backup and dump file checks

New

Looks for commonly named archive, database dump and backup files in public paths.

Open directory listing detection

New

Flags folders that list their contents to any visitor.

Grounded Copilot and plain-English fixes

Available

Once a finding exists, the Copilot explains what is exposed and how to remove it and rotate anything that may have leaked.

Monitoring, alerts and shareable reports

Available

Scheduled scans, email alerts and dated reports are available today and will carry the new checks as they ship.

Public storage bucket checks

Roadmap

Detecting publicly readable cloud storage tied to your domain is planned but not yet built.

Roadmap items are not available yet. They are shown so you can judge fit honestly. Nothing marked Roadmap should be read as a working feature, a certification or a detection capability.

How it works

How Data Exposure works

1
Start from your public site
You give PixelPrivate a domain. It only looks at what any visitor could request.
2
Safe, bounded requests
The checks ask for a short list of well-known sensitive paths and note whether they respond. They are designed to be non-intrusive.
3
We do not keep your content
The goal is to tell you that something is exposed, not to collect it. File contents are not retained.
4
Remove, rotate, verify
Take the file down, rotate any credential that may have been exposed, and re-scan to confirm it is gone.

Honest limits

What Data Exposure does not do

The new checks cover well-known paths on your public website. They do not crawl everything and cannot find every exposed file.
This is not data classification. PixelPrivate does not scan your databases, drives or SaaS apps to identify sensitive data inside them.
It cannot see data behind a login or inside your internal systems.
These checks are being rolled out now. Until you see a finding type in your report, do not assume it has been tested.

Compared with enterprise tools

Enterprise data security platforms classify sensitive information inside cloud stores, databases and SaaS applications, which needs deep access and a dedicated team. PixelPrivate does none of that classification. It looks only at public exposure of files on your website, a narrow job that is nonetheless a common root cause of small-company leaks.

See the full comparison approach

Frequently asked questions

Are the Data Exposure checks live?

They are being added now and are labeled New. The rest of the scanner, monitoring, alerts and reports are available today. We will not describe a check as complete until it ships.

Does PixelPrivate download or store my sensitive files?

The design goal is detection only. It records that a path responded, not the contents, and it does not retain file content.

If a .env file is exposed, what should I do?

Remove it from the public path, treat every secret in it as compromised and rotate the credentials, then re-scan to confirm. The Copilot can walk through this for your stack.

Is this the same as data loss prevention or data classification?

No. Those tools inspect data inside your systems. This is a narrow outside-in check for files that are publicly reachable on your website.

Tools, guides and pricing

Start with data exposure today

Run the free check on your domain, or start the 14-day trial of monitoring and alerts.