robots.txt lists sensitive paths
robots.txt mentions a path such as /admin, /wp-admin, /.env, /backup, /phpmyadmin, or /server-status.
Why it matters
robots.txt is public. Listing those paths tells anyone they exist, even when Disallow asks crawlers to skip them.
What to do
Remove administrative and backup paths from robots.txt. Do not rely on it as access control.
Reference
Server and framework disclosure headers reveal implementation details useful to attackers.