Why it matters
Your server is showing a file-explorer view of its folders, so anyone can find files you never linked to, like backups or uploads.
How to check it yourself
Visit folders like yoursite.com/assets/ or /uploads/. If you see a plain 'Index of' page listing files, visitors can browse your server's folders.
What the fix involves
Disable auto-indexing: autoindex off on Nginx, Options -Indexes on Apache, or turn off public listing on your storage bucket. Then check those folders for anything that shouldn't be public.
Reference: owasp.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.