Storage of File with Sensitive Data Under Web Root

Web servers are designed to serve files from a specific root directory, like `/var/www/html` or `C:\inetpub\wwwroot`. Developers often mistakenly place backup files, configuration files containing passwords, or temporary data dumps in these folders. Since these files aren't meant to be web pages, they are frequently overlooked when setting up access controls. If the server isn't explicitly configured to block access to these sensitive file types, an attacker can simply guess or discover their URLs and retrieve them directly. This bypasses the application's normal security checks, leading to immediate data exposure. The core issue is the failure to separate private data storage from the public content meant to be served by the web application.