fixes:
  - id: 1
    explanation: 'There should generally be no good reason to expose server logs through a web URL of the server itself, epecially not when that server is Internet-facing.'
  - id: 2
    explanation: "Switching off the detailed view option is a cosmetic change on the directory listing but still allows the logs to be browsed and accessed."
  - id: 3
    explanation: 'Removing the route that serves individual log files is likely to plumb the data leak but still provides information to the attacker unnecessarily.'
  - id: 4
    explanation: 'Removing only the directory listing will still allow attackers to download individual log files if they can come up with a valid file name.'
hints:
  - "Can you identify one or more routes which have something to do with log files?"
  - "Did you spot the directory listing clearly linked to log files?"
  - "Did you notice that there is a seperate route for retrieving individual log files?"
  - "Make sure to select both lines responsible for the log file data leakage."
