` or otherwise creates a complete application-layout root. A page partial should render only the fragment it owns. **Risk:** Nested layout roots can create duplicated grids, broken AdminLTE geometry, accidental repeated headers/sidebar/footer, and difficult-to-debug CSS behavior. **Find the exact files:** ```bash grep -RIn --include='*.php' 'app-wrapper' \ /home/intel145/websites/apps/defapp/pages ``` **Fix:** - Keep the single `.app-wrapper` in the primary application template or entry layout. - Remove `

` and its matching closing tag from `pages/` files. - A `pages/` partial may contain local fragments such as breadcrumb navigation, a table card, modal body content, or a sidebar inner navigation list. - A `pages/` partial must not own `.app-wrapper`, `.app-main`, the global application header, or the global sidebar shell. **Example:** Incorrect partial: ```php

``` Correct partial: ```php ``` ### STRUCT-005 — multiple PHP files declare `app-wrapper` **Meaning:** More than one PHP file in the app tree contains an application wrapper declaration. **Important:** This is a heuristic. Files under `old/`, fixtures, alternate examples, or unused test pages may legitimately contain historical layouts. The audit now classifies live files as failures and files below approved legacy directories as warnings. **Find all matches:** ```bash grep -RIn --include='*.php' 'app-wrapper' \ /home/intel145/websites/apps/defapp ``` **Fix choices:** 1. **Active component duplicate:** remove the wrapper from the include partial. 2. **Old/unused page:** move it outside the served application root, delete it if no longer needed, or keep it below `old/` and register the legacy directory policy. 3. **Separate standalone demo:** move it into a dedicated examples/test repository or register it explicitly as an excluded audit path. 4. **Multiple legitimate entry apps in one tree:** use per-app policy files and separate app roots rather than treating all files as one app. Do not suppress this finding globally without reviewing each match. ### SEC-001 — sensitive file types exist **Meaning:** The audit found one or more files with names commonly requiring deployment review, such as `.env`, `.ini`, `.log`, `.sql`, `.sqlite`, `.bak`, or `.backup`. **Find details:** ```bash find /home/intel145/websites/apps/defapp -type f \ \( -iname '.env' -o -iname '*.ini' -o -iname '*.log' \ -o -iname '*.sql' -o -iname '*.sqlite' -o -iname '*.bak' \ -o -iname '*.backup' \) -print ``` **Fix:** - Move secrets, private logs, database dumps, and backups outside the web-served application root whenever possible. - Do not commit production `.env` files, database dumps, or backups to a served app directory. - If a non-secret configuration file must remain in the source tree, ensure Nginx/hosting configuration denies direct HTTP access. - Record an approved exception only when the file is required and its content/exposure is understood. ### ROUTE-001 — public application root could not be checked **Meaning:** The route check did not receive a usable result. It is not a pass. **Common causes:** - `--base-url` was omitted. - An invalid base origin was passed. - DNS, TLS, firewall, WAF, or hosting policy blocked command-line requests. - A shell variable/argument was malformed. **Correct command:** ```bash /home/intel145/websites/system/bin/system-app-audit.sh \ defapp \ --base-url https://apps.intellihometech.com \ --details ``` The base URL is an origin only. Do not include `/defapp`, paths, Markdown brackets, or parentheses: ```text Correct: https://apps.intellihometech.com Incorrect: https://apps.intellihometech.com/defapp/ Incorrect: [https://apps.intellihometech.com](https://apps.intellihometech.com) ``` If the browser receives HTTP 200 but CLI checks return 406 or 5xx, record an `ERROR` and verify using browser DevTools Network plus hosting/WAF logs. Do not change application code solely to satisfy an unreliable external curl result. ### ROUTE-002 — public CSS does not return HTTP 200 **Meaning:** A configured public CSS file could not be confirmed as public. **Fix:** - Confirm the file exists at `css/app.css` beneath the audited app root. - Confirm the browser Network panel loads `/APP/css/app.css` with HTTP 200 and a CSS content type. - Check Nginx/hosting rules do not deny `css/`. - Do not put `` tags inside external `.css` files. - If command-line traffic receives 406/500 while browser traffic succeeds, treat CLI output as `ERROR`, not a confirmed fail, and investigate the hosting/WAF layer. ### ROUTE-003 — an internal partial is publicly accessible **Meaning:** A path such as `/APP/pages/breadcrumbs.php` returned HTTP 200. **Fix on Nginx:** ask the Nginx/hosting configuration owner to add an app-specific rule: ```nginx location ^~ /defapp/pages/ { deny all; access_log off; log_not_found off; } ``` Also evaluate `config/`, `includes/`, and `old/` if those directories contain non-public source files. Do not block `css/`, `js/`, `images/`, or other intentionally public asset directories. Nginx must be configured at the server/hosting level. `.htaccess` does not apply to Nginx. ### HYG-001 — style tags in an external CSS file **Fix:** remove `` tags. An external stylesheet served through `` must contain raw CSS only. ### HYG-002 — backup/editor files found **Fix:** delete unneeded files, move retained copies outside the served root, or add an Nginx deny policy for the relevant extensions. Do not rely only on obscurity. ## Safe remediation order 1. Run `--details` and collect exact paths/lines. 2. Classify each item as active source, known legacy, generated file, or false positive. 3. Fix active layout/component ownership first. 4. Move/remove exposed secrets, dumps, backups, and logs from the served root. 5. Request Nginx/hosting rules for internal source prefixes. 6. Test current page and assets in browser DevTools. 7. Re-run the audit with a report file. 8. Commit application-source changes separately from deployment/infrastructure changes. ## Do not do this - Do not use the audit tool to delete files. - Do not add Apache `.htaccess` files to solve Nginx production routing. - Do not rename all legacy files in one unreviewed bulk operation. - Do not mark 5xx, timeouts, or WAF failures as successful private-path protection. - Do not pass arbitrary shell commands, filesystem paths, globs, or URLs into an admin audit endpoint.