Scan rule · RSC-SEC-095
package.json publicly accessible
Checks whether `/package.json` serves the project file with its name and dependency list.
Why this matters
package.json is your project's inventory: every library with its version range, often scripts, internal package names and the Node version too. Public, that is a ready-made target list — anyone hunting a known vulnerability in one of your libraries no longer has to guess your stack.
It almost always happens the same way: Vite and Create React App ship everything in `public/` verbatim, and the file ended up there while tidying — or the deploy directory points at the project root instead of `dist/`. In generated apps it goes unnoticed because the preview shows nothing of it.
Check it yourself: `curl -s https://your-domain.com/package.json | head`. If JSON with `dependencies` comes back, the file is public. The scan only reads it — it deliberately derives no vulnerabilities from the version ranges, because `^18.2.0` is not an installed version.
Scan tier
How to fix it
Remove the file from the publish directory — clean `public/` or point the deploy directory at the build folder (`dist/`, `build/`, `.next/`).