Repository navigation
Tuner Finding Reference
Every finding ID Tuner 0.4.0 can produce, with its default severity and what it means. Use these IDs with --id, --exclude-id, .tuner.yml ignore entries and baselines. Each ID has its own heading, so #leak-dotenv links straight to it. SARIF reports and rhythm tuner explain link here the same way.
There are three kinds:
-
Remote checks: the YAML checks a scan runs against a URL. They have a profile and
rhythm tuner checkslists them. - Vulnerability and version findings: from matching detected versions against advisory data. They appear in remote and local scans.
- Local findings: from scanning a site's folder on the server, including integrity and malware findings.
IDs written with <…> are patterns: vuln-plugin-<slug> becomes vuln-plugin-contact-form-7. Select a whole family with a glob, e.g. --id 'vuln-plugin-*'. A likely severity means the finding has low confidence: it counts half in the Tune score.
Tip
rhythm tuner explain <id> prints an entry's full text offline: severity, impact, the whole fix with nginx and Apache snippets and references. For a vulnerability or local ID it prints the rule's title, severity and tags and links back here.
$ rhythm tuner explain leak-dotenv
leak-dotenv: .env file exposed
Severity: critical
Confidence: high
Profile: quick
Tags: leak, secrets, php, laravel, wordpress
Requests: /.env /.env.local /.env.production /.env.backup
Impact
Anyone can read database passwords, API keys and app secrets.
Fix
Deny access to dotfiles, then rotate every secret in the file.
nginx
location ~ /\.(?!well-known) { deny all; }
Apache
<FilesMatch "^\.">
Require all denied
</FilesMatch>
References
https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
More
https://github.com/RhythmShahriar/rhythm/wiki/Tuner-Finding-Reference#leak-dotenv
77 checks, generated from rhythm tuner checks --json and rhythm tuner explain --json on Tuner 0.4.0, matching the check files in checks/. Every check sends only GET or HEAD requests.
Each entry gives the severity, the cheapest profile that runs it (quick checks run in every profile, default checks in default), the platform it needs when it only runs on one and whether rhythm tuner fix has a server snippet for it. The text is the finding's title and impact.
low · quick · server snippet · X-Content-Type-Options header missing. Browsers may MIME-sniff uploads and run them as scripts.
medium · quick · Session cookie readable by JavaScript. Any XSS bug can steal the session cookie and take over the account.
low · quick · Cookie set without Secure flag. The cookie is also sent over plain HTTP, where it can be intercepted.
low · quick · server snippet · Content-Security-Policy header missing. Without a CSP, an XSS bug can load scripts from anywhere.
low · quick · server snippet · Clickjacking protection missing. Pages can be framed by other sites, which allows clickjacking.
medium · quick · server snippet · HSTS header missing. Visitors can be downgraded to plain HTTP on hostile networks.
low · quick · server snippet · X-Powered-By leaks version. Reveals the exact PHP version, making known vulnerabilities easy to target.
info · quick · server snippet · Referrer-Policy header missing. Full URLs, including query strings, may leak to third-party sites.
low · quick · server snippet · Server header leaks version. Reveals the exact web server version, making known vulnerabilities easy to target.
critical · default · server snippet · Site backup archive exposed. A full copy of the site, usually including configuration and secrets, can be downloaded.
medium · default · server snippet · .bzr (Bazaar) directory exposed. The repository and its history can be downloaded.
critical · default · server snippet · Composer auth.json exposed. Private package registry tokens are readable.
low · default · server snippet · Composer manifest exposed. Exact package versions are visible, which makes known vulnerabilities easy to target.
critical · quick · server snippet · .env file exposed. Anyone can read database passwords, API keys and app secrets.
low · default · server snippet · .DS_Store file exposed. macOS folder metadata lists file names in the directory, including hidden backups.
low · default · server snippet · .DS_Store file exposed in a subfolder. macOS folder metadata lists file names in the folder, including hidden backups and plugin names.
high · default · server snippet · Example .env file with real secrets. The example file was filled with real keys, which are now public. Example files are usually not covered by dotfile rules that list .env only.
medium · default · server snippet · PHP error log exposed. Error logs reveal server paths, plugin names and sometimes credentials.
high · quick · server snippet · .git directory exposed. The full source code and history can be downloaded, often including old credentials.
high · default · server snippet · .git index exposed. The index lists every file in the repository. With the rest of .git the full source and history can be rebuilt.
high · default · server snippet · .git logs or HEAD files exposed. The files confirm a readable .git folder and show commit IDs, authors and remote URLs, which may hold tokens.
high · default · server snippet · .hg (Mercurial) directory exposed. The repository can be downloaded with its full history, often including old credentials.
high · default · server snippet · .htpasswd file exposed. Password hashes for HTTP basic auth can be downloaded and cracked offline.
medium · default · server snippet · JetBrains .idea folder exposed. IDE project files list source paths, recent files, run settings and database connections.
low · default · needs PHP · server snippet · Node package files exposed on a PHP site. The front-end build's packages and versions are public, which points at known flaws. The files also show the deploy copies the whole project.
low · default · server snippet · npm or yarn debug log exposed. Build logs show local paths, package versions, environment details and sometimes registry tokens.
high · default · server snippet · Editor SFTP settings exposed. Editor deploy settings name the server, user and remote path and often hold the FTP or SSH password.
critical · default · server snippet · SQL database dump exposed. The whole database can be downloaded, including user emails and password hashes.
medium · default · server snippet · Old or staging folder listed. Anyone can browse an old copy of the site, which often holds config files, database dumps and outdated plugins.
high · default · server snippet · .svn directory exposed. Subversion metadata exposes file names and can allow source code download.
medium · default · server snippet · Composer vendor folder listed. Every installed package is listed and its files can be fetched directly, including tests and tools never meant to run on a public server.
critical · default · server snippet · wp-config.php source or backup exposed. Database credentials and authentication salts are readable, which allows full site takeover.
critical · default · server snippet · Other copy of wp-config.php exposed. Database credentials and authentication salts are readable, which allows full site takeover.
medium · default · server snippet · Adminer database tool exposed. A public database login page invites password guessing against the database.
medium · quick · PHP errors shown to visitors. display_errors is on, so error messages reveal server paths and code details to anyone.
low · default · server snippet · PHP settings file exposed. PHP settings such as disabled functions, open_basedir and log paths are readable, which helps plan an attack. An auto_prepend_file line can point at injected code.
medium · default · server snippet · phpinfo() page exposed. Shows the PHP version, loaded modules, server paths and environment variables, which may include secrets.
medium · default · server snippet · phpinfo() page exposed at another name. Shows the PHP version, loaded modules, server paths and environment variables, which may include secrets.
medium · default · server snippet · phpMyAdmin login page public. The database admin login is open to the internet, so anyone can guess passwords against it. Old phpMyAdmin versions have known flaws.
medium, likely · default · phpinfo() shows settings exposed to CVE-2026-115560. CVE-2026-115560 is an unpatched flaw in PHP's session upload progress. It is reachable when the serialize handler is php_binary or php_serialize, the application switches it to php with ini_set() before session_start() and upload progress is enabled. This page shows the two configuration conditions hold; whether the code switches the handler can only be checked on the server: run rhythm tuner scan /path/to/site there.
high · default · server snippet · Symfony dev front controller public. The site runs in debug mode through this file, with the debug toolbar and profiler showing requests, queries and configuration.
high · default · server snippet · Symfony profiler public. The profiler shows every recent request with its headers, session, queries and environment, secrets included.
high · default · server snippet · Laravel Debugbar request history public. Debugbar keeps recent requests with their queries, session data and headers. This endpoint hands them to anyone.
medium · default · Laravel Horizon dashboard public. Anyone can see queued jobs and their data and retry or delete failed jobs.
high · quick · server snippet · Laravel Ignition debug endpoints exposed. Debug mode is on in production. Older Ignition versions allow remote code execution (CVE-2021-3129).
high · quick · server snippet · Laravel log file exposed. Stack traces reveal source paths, queries and often credentials from exception context.
high · default · server snippet · Laravel storage folder listed. Logs, cached views and session files can be browsed. They hold errors, queries and session data.
high · default · Laravel Telescope dashboard public. Telescope shows every request, query, job, mail and exception, often with session data, tokens and personal data.
medium · default · server snippet · Apache server-info page public. The page shows the full server configuration, loaded modules and file paths.
medium · default · server snippet · Apache server-status page public. The page shows every request being served, with client IP addresses, URLs (query strings and tokens included) and virtual hosts.
low · default · crossdomain.xml allows every domain. Flash or Silverlight clients on any other site may read this site with the visitor's cookies.
high · default · server snippet · ELMAH error log public. The log shows every recent exception with its request, cookies and server variables, so sessions can be hijacked.
low · default · server snippet · nginx status page public. Connection counts show the site's load, which helps time or measure a denial-of-service attack.
medium · default · server snippet · IIS web.config exposed. The IIS config of a migrated site is readable, with rewrite rules and sometimes connection strings and keys.
high · quick · TLS certificate expired. Browsers show a full-page warning. Visitors who click through are open to interception.
medium · quick · TLS certificate expires soon. The site will show a browser security warning when the certificate expires.
high · quick · TLS certificate not trusted. The certificate is self-signed, issued by an unknown authority, or doesn't match the hostname, so browsers warn visitors.
medium · default · server snippet · Obsolete TLS 1.0/1.1 accepted. TLS 1.0 and 1.1 are deprecated (RFC 8996) and have known weaknesses.
medium · quick · Site served over plain HTTP. Logins and cookies travel unencrypted. The site doesn't redirect to HTTPS.
info · default · needs WordPress · admin-ajax.php reachable. admin-ajax.php is public on every WordPress site and serves plugin actions, including ones for logged-out visitors (wp_ajax_nopriv_*). Many plugin vulnerabilities live in these handlers. Tuner doesn't call them; known plugin CVEs are reported by the vulnerability checks.
critical · default · needs WordPress · server snippet · All-in-One WP Migration backups listed. Each .wpress file is a full copy of the site and its database, ready to download.
high · default · needs WordPress · server snippet · BackWPup folders listed in uploads. The listing names the folders where BackWPup keeps backups and logs. If those list too, the whole site can be downloaded.
high · quick · server snippet · WordPress debug.log exposed. The log reveals server paths, plugin errors and sometimes queries with personal data.
high · default · server snippet · WordPress debug log exposed in another folder. The log reveals server paths, plugin errors and sometimes queries with personal data.
medium · default · needs WordPress · server snippet · Directory listing enabled. Anyone can browse every uploaded file and the exact plugins and themes installed.
critical · default · needs WordPress · server snippet · Duplicator backup archives listed. The listing links to Duplicator packages, each a full copy of the site and its database.
high · default · server snippet · Duplicator installer left on the site. The Duplicator installer can overwrite the site and its database. It also reveals paths and the name of the package archive.
info · default · needs WordPress · server snippet · WordPress readme.html present. Confirms WordPress and can hint at the installed version.
low · default · needs WordPress · server snippet · WordPress version shown in readme.html. The exact WordPress version is public, which points attackers at the flaws it has. Only old releases print it, so the core is likely out of date too.
medium · default · server snippet · Old or staging WordPress copy reachable. A second WordPress install is live next to the site. Copies are rarely updated, so their core and plugins are easy targets. They often share the database password.
critical · default · needs WordPress · server snippet · UpdraftPlus backups listed. The listing links to full site backups, the database with password hashes and personal data included.
high · default · needs WordPress · server snippet · PHP file listed in uploads. Uploads should hold media only. A PHP file there is often a web shell left by an attacker. The open listing shows it to anyone.
medium · quick · needs WordPress · User enumeration via REST API. Login names are public, which halves the work of a password-guessing attack.
medium · default · needs WordPress · User enumeration via ?rest_route=. Login names are public, which halves the work of a password-guessing attack. Blocking /wp-json/ alone does not stop this form of the request.
high · default · needs WordPress · server snippet · WooCommerce logs listed. WooCommerce logs can hold order details, customer emails and payment gateway responses.
medium · default · needs WordPress · server snippet · WPForms uploads listed. Files people sent through forms, such as CVs and ID scans, can be browsed by anyone.
low · quick · needs WordPress · server snippet · XML-RPC enabled. XML-RPC allows many password guesses in a single request and is often used for pingback abuse.
From matching detected versions against vulnerability data. They run alongside the checks in every profile and are skipped with --no-vulns. A vuln-* finding's severity is the worst severity among the advisories that apply (an unrated advisory counts as medium); the severity listed here is the default explain shows. vuln-php, vuln-nginx, vuln-apache and the *-eol findings drop to likely when the version string names a distribution build, which may include backported fixes.
worst advisory · WordPress core with known vulnerabilities. Published vulnerabilities affect the installed WordPress version.
low · WordPress core out of date. A newer WordPress release exists. Reported only when vuln-core isn't.
worst advisory · vuln-plugin-<slug> · Plugin with known vulnerabilities. Published vulnerabilities affect the installed version of this plugin.
worst advisory · vuln-theme-<slug> · Theme with known vulnerabilities. Published vulnerabilities affect the installed version of this theme.
medium · Plugin closed on wordpress.org, often for an unfixed security issue.
medium · Theme closed on wordpress.org.
low · Plugins or themes out of date. Newer releases exist on wordpress.org; one finding lists them all.
low · Plugins or themes that look abandoned: no release in over two years.
info, likely · Plugins or themes with known vulnerabilities and an unknown version. Some versions are affected; the installed version couldn't be read.
worst advisory · PHP version with known vulnerabilities. On end-of-life branches it includes inferred flaws that will never be fixed there.
high · PHP branch past end of life. It no longer gets security fixes.
medium, likely · PHP version hidden while recent critical flaws are out, so they can't be ruled out.
worst advisory · nginx version with known vulnerabilities.
worst advisory · Apache version with known vulnerabilities.
medium · nginx branch past end of life.
medium · Apache branch past end of life.
worst advisory · vuln-composer-<vendor>-<package> · Composer package with known vulnerabilities, matched with OSV.dev. Local scans read composer.lock; remote scans match an exposed composer.lock or vendor/composer/installed.json (up to 500 packages) and say (from exposed composer.lock) in the title.
From rhythm tuner scan <folder>. See Local scans and Integrity and malware. Every local finding carries the local tag, so --tags local or --id 'local-*' selects them. Their locations are file:// URLs; SARIF gives paths relative to the scanned folder. A local ID that only a check pack's local rules produce has no entry of its own and links to this section.
medium · Keys and salts in wp-config.php are missing, the sample placeholder, empty or duplicated, so a database leak lets an attacker forge login cookies. The evidence names the line.
medium · WP_DEBUG is on and errors are shown to visitors, or logged to the public wp-content/debug.log. low when errors are hidden and logged elsewhere.
low · Neither DISALLOW_FILE_EDIT nor DISALLOW_FILE_MODS is true, so an admin account takeover becomes code execution.
low · wp-config.php is readable by every user on the server. Not checked on Windows.
info · Tables use the default wp_ prefix. Obscurity only, no score penalty.
info · FORCE_SSL_ADMIN isn't true.
info · Must-use plugins are installed; they always run and aren't matched against vulnerability data.
medium · APP_DEBUG=true in a Laravel project's .env. The evidence names the line.
When wp-config.php includes other files, the findings about missing settings are likely: the setting may be defined there.
high (medium without secrets) · An environment file (.env, .env.production, .ENV…, not .env.example) is in the web root.
high · A copy of wp-config.php (.bak, .old, .save, ~, .swp…) that the server would send as plain text.
high · A database dump (*.sql, *.sql.gz…) or SQLite file.
high · A backup-looking archive, a .wpress file, or any archive at the top of the web root.
high · Composer auth.json with tokens.
high · A private key (*.pem, *.key, id_rsa…).
medium · A .git, .svn or .hg folder.
medium · A backup copy of a PHP file, e.g. functions.php~.
medium · A log file such as debug.log or error_log.
medium · A PHP file that calls phpinfo().
medium · Adminer or phpMyAdmin.
high to info · CVE-2026-115560 preconditions. High when all four conditions hold; high and likely when the configuration is unsafe but the order of calls couldn't be confirmed from one file; medium and likely when the code switches the serialize handler but PHP's configuration couldn't be read; low when the configured handler is php; info when upload progress is off everywhere checked.
From --integrity. See Integrity and malware.
critical · Modified WordPress core file: its MD5 differs from the one WordPress.org publishes for the installed release. high when the core file was replaced by a link that points outside the install or doesn't resolve.
high · Unexpected PHP file in WordPress core: a .php file in wp-admin/ or wp-includes/ that the release doesn't have.
low · WordPress core files missing. One finding lists up to 20 paths.
high · Modified file in a wordpress.org plugin: its SHA-256 differs from the plugin release's checksums.
medium · Unexpected PHP file in a wordpress.org plugin.
info · Plugins not on wordpress.org weren't compared, because WordPress.org has no checksums for them. Premium and custom plugins land here.
medium, likely · A wordpress.org plugin at a version wordpress.org never released, so its files weren't compared. A development build does this too; so does a Version: header edited to hide changed files.
Declarative rules that read file contents and never run them. See Integrity and malware for what each one skips.
high, likely · PHP file in the uploads folder (.php, .phtml, .phar and the like under wp-content/uploads). "Silence is golden" index files are exempt.
critical · eval() of base64-decoded code.
high · Compressed and base64-encoded code (gzinflate, gzuncompress or gzdecode of base64_decode).
critical · assert() runs request input.
high · preg_replace() with the /e modifier.
critical · create_function() built from request input.
critical · Known web shell (FilesMan, WSO, b374k, c99, r57 markers).
critical · auto_prepend_file loads a file from uploads (in .user.ini, .htaccess or php.ini).
critical · Must-use plugin creates a hidden admin user.
Local scans also report every vulnerability and version finding above, using versions read from disk.
← Check packs · Home · CLI reference →
rhythm · Useful ideas. Working systems. · Check only sites you own or have permission to test. Keep staging sealed (responsible use) · This wiki is published from wiki/ in the rhythm repository; suggest changes there with a pull request.
Get started
rhythm in depth
Tuner
- Overview
- Your first scan
- Reading results
- Choosing checks
- Requests and politeness
- Output and reports
- Batch scans
- Local scans
- Integrity and malware
- Changes and notifications
Tuner in depth
- Known vulnerabilities
- PHP advisories
- CI and code scanning
- GitHub Action
- Config file
- Watch and serve
- Writing checks
- Check packs
- Finding reference
- CLI reference
- Coming from Wordfence CLI or WPScan
- FAQ and troubleshooting
Soundcheck
- Overview
- Your first check
- Reading results
- Review and accept
- Discovery
- Page health
- Visual changes
- Interactions
- Forms and flows
- Cache
- Speed
- Accessibility and SEO
- EAA mode
- Keyboard walkthrough
- Accessibility statement
Soundcheck in depth
- CI
- CI baselines and PR comments
- Configuration
- Error rules and exec
- WordPress updates
- Fleet and client reports
- History
- Import from BackstopJS and Lost Pixel
- Firefox and WebKit
- CLI reference
- FAQ and troubleshooting
- Benchmark
Echo
- Overview
- Your first run
- Connectors
- Sealing staging
- Echo Inbox
- Messages and checks
- Checks and rules
- Attachments
- Actions and compare
- With Soundcheck
- Replay
- Deliverability
Echo cookie consent
Echo in depth
- Docker and DDEV
- Agency hub and reports
- Schedule
- MCP server
- Conformance kit
- CI
- Configuration
- API
- CLI reference
- FAQ and troubleshooting
- Benchmark
Roadie
- Overview
- Getting started
- Copy and prepare
- Sources and targets
- Profiles
- Pseudonymisation
- Live keys
- Kill switch
- Verify and reports
Roadie in depth
- Laravel
- Generic SQL and Postgres
- Multisite
- CI and the GitHub Action
- Configuration
- Security and limits
- CLI reference
- Troubleshooting
- FAQ and honest limits
- Benchmark
Sightread
- Overview
- Your first review
- Signal reference
- Allow and baseline
- Sources and integrity
- With Soundcheck and Roadie
- Watch
Sightread in depth
- CI and the GitHub Action
- Configuration
- Output and reports
- Security model
- CLI reference
- FAQ and honest limits
- Benchmark
Project