A similar issue I've found before on live sites: people exposing the source of php of files through backup files named with the ~ suffix produced by editors lik

A similar issue I've found before on live sites: people exposing the source of php of files through backup files named with the ~ suffix produced by editors like Emacs or vim. In a standard LAMP stack, files with names ending in ".php" get executed and don't have their raw contents exposed, but files with names ending in ".php~" get no special treatment. If the admin uses Emacs or vim to edit any php files directly on the server, then ".php~" files will be produced which will be accessible by default. If a page has a URL like example.com/foo.php, then example.com/foo.php~ may be accessible and expose the source code (and possibly database credentials, etc).