.DS_Store is a hidden file macOS automatically creates in every folder you browse in Finder — if a developer uploads files to your server from a Mac without cleaning these up, they can end up publicly accessible and reveal a full list of every filename in that directory, including ones with no direct links pointing to them.
A Mac Finder artifact that quietly leaks your real directory structure and file names to anyone who requests it — harmless to create, easy to forget, trivial for an attacker to use for reconnaissance.
Exposed .DS_Store files, a macOS-specific file automatically created by the Finder application to store folder view preferences and metadata, can inadvertently reveal your actual file and directory structure when accidentally included in your deployed website files — this represents a specific, common oversight for developers working on macOS systems.
These files, while seemingly innocuous, can reveal genuine information about your file organization, including filenames and folder structures never intended for public disclosure — this provides the same kind of reconnaissance value discussed regarding directory listing exposure, revealing your actual file structure to anyone who discovers these specific files.
This exposure typically occurs through simple oversight in deployment processes — these files get automatically created during normal macOS file system browsing and are easy to accidentally include in a deployment if your build or upload process doesn't specifically exclude them, making this a common, unintentional exposure rather than any deliberate configuration choice.
Remediation involves both removing any currently exposed instances and, importantly, adding these files to your deployment exclusion process going forward — ensuring your build or deployment configuration specifically excludes these files prevents this same oversight from recurring with future deployments.
No .DS_Store files are accessible via direct URL, and your deployment process excludes them going forward.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →