# /config/database.yml accessable in beta/alpha

**URL:** <https://www.ruby-forum.com/t/config-database-yml-accessable-in-beta-alpha/184535>\
**Category:** Deployment\
**Created:** [March 4, 2010, 3:01am UTC](https://www.ruby-forum.com/t/config-database-yml-accessable-in-beta-alpha/184535 "2010-03-04T03:01:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![toddf](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a6a055/32.png) [@toddf](https://www.ruby-forum.com/u/toddf)\
**Post date:** [March 4, 2010, 3:01am UTC](https://www.ruby-forum.com/t/config-database-yml-accessable-in-beta-alpha/184535/1 "2010-03-04T03:01:34Z")

</div>

we’re not sure how to stop this, but on a few of our projects the  
database.yml is accessble and on others it’s not (only in an alpha/beta  
environment, production is OK).

regardless we still need to stop it from being accessed.

an example is [beta.mydomain.com/config/database.yml](http://beta.mydomain.com/config/database.yml)

that will actually download the database.yml file. any ideas on how to  
stop this from happening?

we’ve tried blocking it in the nginx config to no avail. it has to be  
something we’ve done to our ruby configs somewhere.

thanks

---

<div class="post-metadata">

**Author:** ![toddf](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a6a055/32.png) [@toddf](https://www.ruby-forum.com/u/toddf)\
**Post date:** [May 24, 2010, 9:07pm UTC](https://www.ruby-forum.com/t/config-database-yml-accessable-in-beta-alpha/184535/2 "2010-05-24T21:07:30Z")

</div>

> an example is [beta.mydomain.com/config/database.yml](http://beta.mydomain.com/config/database.yml)

your rails app should only “reveal” its public folder and  
contents…really it should…

---

<div class="post-metadata">

**Author:** ![toddf](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/a6a055/32.png) [@toddf](https://www.ruby-forum.com/u/toddf)\
**Post date:** [August 18, 2010, 11:01am UTC](https://www.ruby-forum.com/t/config-database-yml-accessable-in-beta-alpha/184535/3 "2010-08-18T11:01:53Z")

</div>

Roger P. wrote:

> > an example is [beta.mydomain.com/config/database.yml](http://beta.mydomain.com/config/database.yml)
> 
> your rails app should only “reveal” its public folder and  
> contents…really it should…

yeah should… but it’s not.

if i go direct to that file and folder i can download the yml.

is there a config issue or environment setting we can update? it only  
happens on non production environments.