Deploy conventions are attack surface
Lesson 4 of six in Claude Code Field Notes: Running AI Coding Agents in Production, drawn from operating more than twenty live software surfaces with Claude Code.
On some platforms, every file in a specific directory becomes a public HTTP route. Filename maps to URL, with no other gate. That convention is convenient until a colocated test file lands there.
A file named something.test.js in that directory is not a test. It is an unauthenticated endpoint
that executes a test suite inside a production function when anyone requests it, boots whatever
servers the test defines, and holds the invocation open toward the platform's timeout ceiling.
Anyone who finds it can loop it.
The audit is one line per candidate file, and it checks production rather than your file tree:
curl -s -o /dev/null -w '%{http_code}' https://<domain>/api/<basename>Anything that is not a real endpoint should answer 404. Treat every file under a route-mapped directory as a public URL, and confirm it against the deployed site rather than the repository. Framework conventions differ, so learn which of yours maps filenames to routes.