The author says they aren’t a security person, so to correct a minor thing: the first examples are credential and configuration discovery, not directory travers

The author says they aren’t a security person, so to correct a minor thing: the first examples are credential and configuration discovery, not directory traversal. The latter, to the best of my knowledge, is reserved for techniques where the attacker “escapes” the webroot or otherwise convinces the server to serve things outside of its normal directories.