Is a public .svn folder a vulnerability?

Yes — it is an information-leak class, same family as a public .git. Deny it at the edge and stop deploying working copies.

Does RoastMyOpsec fetch .svn?

Not as a scored path today. It does probe .git/HEAD. Deny both prefixes anyway.

Will the scanner dump my repository?

No. Bounded GETs and signatures only. No recursive dump, no exploit payload.

Vulnerabilities

Exposed .svn vs .git on Production Websites

October 10, 2023

Exposed .svn vs .git on production websites is the same incident class in two version-control costumes. A public /.git/HEAD (and the objects beside it) can donate source, history, and sometimes secrets that were committed. A public /.svn directory is Apache Subversion working-copy metadata — entries, pristine files, wc.db — that can donate the same kind of inventory. Neither belongs next to index.html. robots.txt Disallow is not a lock. RoastMyOpsec probes /.git/HEAD with a bounded GET looking for a signature. It does not currently score /.svn, does not dump repositories, and does not reconstruct working copies.

The practical difference

Git leftovers show up when a deploy copies the whole repo instead of an export. SVN leftovers show up on older PHP and Java shops that checked out on the server. .env in the document root is a third channel. IDE folders are a fourth. Treat all as publish denylist plus CDN deny.

A 404 on /.svn/entries is not proof the working copy is gone from another prefix or an old wc.db path.

How to choose what to strip

CI: publish an artifact that never contains .git, .svn, .hg, or .bzr. CDN: deny those prefixes even if CI is perfect. Server: never checkout into the document root. Staging hostnames that are guessable get the same rules. Pair with dump.sql if the same zip also held a database.

Leftover	Typical leak	Roast today	Takeaway
/.git/HEAD	Source and history	Bounded signature GET	Incident-class; deny the tree
/.svn/	Working-copy metadata	Not scored; deny anyway	Same class as git
/.env	Live secrets	Bounded signature GET	See .git vs .env
/.vscode/	Editor config	Not scored	See .vscode vs .DS_Store

When SVN still wins (off the public origin)

A private Subversion server is fine. A working copy in the web root is not. Git still wins as the common leak in 2026. Missing .svn on a Node site is healthy.

What the roast can prove

A .git/HEAD signature can surface. .svn is not a scored path. Confirm a deny at the edge. Pair with directory listing if autoindex still lists .svn.

Common mistakes

The first mistake is stripping only .git because 'we migrated from SVN years ago' while an old vhost still has a checkout.

The second mistake is Disallow: /.svn and calling it access control.

The third mistake is treating a roast miss on .svn as proof the working copy is gone.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is a public .svn folder a vulnerability?: Yes — it is an information-leak class, same family as a public .git. Deny it at the edge and stop deploying working copies.
Does RoastMyOpsec fetch .svn?: Not as a scored path today. It does probe .git/HEAD. Deny both prefixes anyway.
Will the scanner dump my repository?: No. Bounded GETs and signatures only. No recursive dump, no exploit payload.

Sources

Related guides

Vulnerabilities
Exposed .git vs .env on Production Websites
Vulnerabilities
Exposed .hg vs .git on Production Websites
Vulnerabilities
.env.example vs .env on Production Origins