Challenge 3: The Forgotten "Temporary" Directory Listing — Solution Walkthrough

What could actually go wrong:

Leaving directory listing enabled means anyone who requests the URL of
that folder — not just the developer who enabled it — sees a full
listing of every file sitting inside it. Per this chapter's own
warning box, this can expose file names nobody intended to publish:
backup files (e.g. an old config.php.bak), configuration snippets,
temporary files left behind during development, or other content that
was never meant to be reachable from the web at all, simply because it
happens to live in a directory the web server can see.

Why this is worse than it might first appear:

The developer's intent was to check the folder's contents personally,
once, from the browser — but enabling directory listing doesn't scope
that visibility to just them. It's a server-wide setting: every future
visitor who requests that same folder's URL, including anyone probing
the site for exactly this kind of accidental exposure, sees the same
listing. A forgotten "temporary" setting like this can sit exposed
indefinitely if nobody remembers to check for it later.

The safer alternative:

Use a local tool (an FTP/SFTP client, a server file-manager, or the
hosting provider's own dashboard) to inspect the folder's contents
directly, rather than exposing directory listing through the live web
server, even briefly.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise applies this chapter's own warning box to a realistic,
easy-to-imagine developer mistake — correctly identifying that the
risk isn't hypothetical or limited to the moment the setting was
turned on, but persists as long as the setting itself remains enabled
and forgotten.