Vulnerabilities
backup.sql.gz vs dump.sql on Production Origins
April 13, 2022
backup.sql.gz vs dump.sql on a production origin is the same database souvenir in two costumes. /dump.sql is often schema and rows in text — the roast signatures SQL-shaped bodies on that well-known name. A .sql.gz is the compressed twin: still a dump, still not a marketing asset. Compression is not access control. RoastMyOpsec may not fetch backup.sql.gz today. It does probe /dump.sql and /backup.zip. Still deny dump and archive names at the edge. Do not Disallow them in robots.txt; that publishes a map of leftovers.
The practical difference
Plain dump.sql is easy to recognize. gzip only changes the wrapper. Either file on a public bucket is a data exposure until proven empty of live rows and credentials.
backup.zip is a cousin the roast already signatures by magic bytes. Directory listing of a backup folder is louder. None of these belong next to index.html. Put archives in private storage with no public ACL.
How to choose based on what you shipped
If any dump-shaped object was public: take it off the origin, deny dump and archive patterns at the CDN, rotate database and app secrets that may have been in the file, and stop writing backups into the document root. CI should fail if those extensions appear in the publish artifact.
| Option | When it wins | Watch-out | Takeaway |
|---|---|---|---|
| /dump.sql | Never on the CDN | Schema and row data | Roast signatures this name today |
| backup.sql.gz / dump.sql.gz | Never on the CDN | Same dump, smaller file | Not always fetched today; deny anyway |
| /backup.zip | Never on the CDN | May hold the dump plus .env | Roast signatures zip magic |
| Private object storage | Retention you actually need | Public ACL recreates the miss | Not the website origin |
When a dump still wins (never as a public URL)
A SQL dump wins in private backup storage with encryption and tight IAM. gzip wins there to save bytes. Neither wins as a guessable path on the brochure host.
Turning off directory listing is necessary and not sufficient. The exact URL can still 200. See directory listing vs 403.
Common mistakes
The first mistake is 'it is gzipped so nobody will read it' on a public URL.
The second mistake is dumping to the web host because disk was handy, then forgetting the file.
The third mistake is Disallowing /backup in robots.txt as if crawlers were the threat.
What a URL roast can prove
Bounded GETs to /dump.sql and /backup.zip with content signatures. .sql.gz names are not a guaranteed scored path today. A clean roast is not a guarantee a uniquely named archive is absent. No unzip-as-exploit, no query against your database.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a public .sql.gz a vulnerability?
- Yes — it is a data exposure. Remove it, deny archive names at the edge, and rotate secrets that may have been inside.
- Does RoastMyOpsec fetch backup.sql.gz?
- Not as a dedicated scored name today. It does probe /dump.sql and /backup.zip. Deny compressed dumps at the CDN anyway. Same class of miss.
- If listing is off, is the gzip safe?
- No. Guessable names still download. Keep dumps off the public origin.
Sources
Related guides
Vulnerabilities
Exposed dump.sql vs backup.zip on ProductionVulnerabilities
Directory Listing vs 403 for Backup and Static FoldersVulnerabilities
robots.txt Disallow vs Access Control for Hidden Paths