v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
HIGH AI PREVALENCE: LOW auth.express.static-dotfiles-allow

A static file handler is configured with dotfiles: 'allow', which serves dotfiles from the mounted directory.

Why AI tools produce this: AI coding tools rarely emit this on their own, but it still slips into assisted edits.

Why this matters

If that directory (or anything under it) contains .env, .git/, .npmrc, .aws/, or similar, an attacker can fetch them directly (for example GET /.env) and harvest OAuth client secrets, API keys, and database credentials.

Remove the option to keep the safe default (dotfiles: 'ignore'), or set dotfiles: 'deny' to return 403. Never serve dotfiles from a public web root; keep secrets out of any statically served directory.

VULNERABLE
vulnerable.ts
import express from 'express';
import serveStatic from 'serve-static';

const app = express();

// ruleid: auth.express.static-dotfiles-allow
app.use(express.static('public', { dotfiles: 'allow' }));

// ruleid: auth.express.static-dotfiles-allow
app.use(serveStatic('build', { index: false, dotfiles: 'allow' }));
SAFE
safe.ts
import express from 'express';
import serveStatic from 'serve-static';

const app = express();

// ok: auth.express.static-dotfiles-allow -- default behaviour (dotfiles ignored)
app.use(express.static('public'));

// ok: auth.express.static-dotfiles-allow -- dotfiles explicitly ignored
app.use(express.static('public', { dotfiles: 'ignore', index: false }));

// ok: auth.express.static-dotfiles-allow -- dotfiles denied (403)
app.use(serveStatic('build', { dotfiles: 'deny' }));

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.express.static-dotfiles-allow -- <reason>

References

https://expressjs.com/en/4x/api.html#express.static ↗https://cwe.mitre.org/data/definitions/538.html ↗