A Portswigger lab exercise demonstrates how source code disclosure through backup files can lead to serious information disclosure vulnerabilities. By inspecting a site's robots.txt, researchers found a disallowed `/backup` directory. Accessing it revealed a `ProductTemplate.java.bak` file containing raw Java source code.

The exposed code included a connection builder with plaintext PostgreSQL credentials—username and password. This simple oversight allows unauthorized access to the database, turning a minor misconfiguration into a critical breach. The exercise highlights a common web application flaw where developers fail to clean up development artifacts before deployment.

This lab reinforces a fundamental bug bounty lesson: always examine `robots.txt` for hidden paths. Such reconnaissance is a standard first step in ethical hacking. The technique is widely applicable, as many applications leave backup files accessible, exposing sensitive configuration and source code to anyone who knows where to look.