适用场景
小型 VPS、Nginx/OpenResty、Cloudflare Worker/Pages、AI API 网关、静态数字产品店和自助 dashboard。目标是减少误暴露，不做攻击。
config.json secret exposure hardening for API gateways and static stores
访问日志里反复出现 /config.json 探测时，说明需要把前端配置、后端 secret 与部署文件边界重新梳理。这个页面只做防御型清单和模板导流。
config.json hardeningAPI gateway securitystatic store secret protectionOpenResty deny rulesCloudflare WAF
包含内容方向
deny 规则、header 建议、日志脱敏、凭据轮换流程、安全验证命令、incident note 模板和产品页文案。
变现路径
搜索长尾页 → ClawSkills 教程/商店 → DontCallMePretty USDT checkout → 自动下载 ZIP。无需人工接单。
Defensive checklist preview
1. Inventory public routes and static files you control.
2. Remove stale config/test/debug files from webroots.
3. Deny dotfiles, backup extensions and accidental JSON/YAML secret files.
4. Rotate any credential that may have been exposed.
5. Verify with harmless GET/HEAD requests only; do not scan third-party systems.
6. Keep no tokens or buyer data in public HTML.
Related pages
config.json hardening · env.txt protection · admin login route hardening · API test endpoint hardening