[shinsenter]

The default Caddyfile used by the Docker image serves dotfiles. php_server includes file_server, and Caddy serves hidden files unless told not to. A .env or .git/config in the document root can be downloaded.

To reproduce:

mkdir -p t/public/.git && echo secret > t/public/.env && echo x > t/public/.git/config
echo '<?php echo "ok";' > t/public/index.php
docker run -d -p 443:443 -v "$PWD/t:/app:ro" dunglas/frankenphp:latest
curl -sk --resolve localhost:443:127.0.0.1 https://localhost/.env

This returns 200 with secret. /.git/config does the same.

The fix adds a matcher to the site block that returns 404 when any path segment starts with a dot, except under /.well-known/. respond runs before php_server, so PHP files and the front controller still work. I used path_regexp plus a not path condition because Caddy's regexp engine (RE2) has no lookahead.

I mounted the changed Caddyfile into dunglas/frankenphp:latest (v1.13.4, Caddy v2.11.7) with a public/ folder that has .env, .git/config, sub/.env, .well-known/security.txt and index.php:

Path	Before	After
/.env	200	404
/.git/config	200	404
/sub/.env	200	404
/.well-known/security.txt	200	200
/index.php	200	200

No Go code changes, so I did not run go test.

I left package/Caddyfile alone. It only serves the default page from /usr/share/frankenphp/.

The default changes for anyone who serves a dotfile on purpose. They can still do it with their own Caddyfile or CADDY_SERVER_EXTRA_DIRECTIVES. I'm sending this as a hardening change to the default config, not as a vulnerability in FrankenPHP, since SECURITY.md asks for those to be reported privately.

[dunglas]

I wonder is this doesn't belong in the Caddy file server directly