Exploring docker-compose.yaml leads to sensitive disclosure

Today i was explore on my target site, suddenly i was found a .env-prod that show for the database connection.

I try connect to the database from the server that appear in the .env, but i can’t connect.. i think the 3306 port is closed. But I didn’t stop from here then I explore againin the entire site again. Then I found docker-compose.yml was disclosed in public :

Yep, you can see what i found, there is a port for connect to the database & redis . Then i try to re-connect again to port 3377, and boom! I can connect to the prods database.

This what i found from the impact of this bug :

Please keep your sensitive file safe from the public.

Happy Hacking!