India's .bank.in Domains Are Leaking Secrets — And It Shouldn't Be This Easy
India’s .bank.in Domains Are Leaking Secrets — And It Shouldn’t Be This Easy An anonymised security scan of RBI’s banking TLD reveals env files, debug endpoints, and framework metadata exposed in plain sight. What happened Prompted by a recent post on X noting that sensitive files on .bank.in domains were trivially accessible, I ran a systematic scan across the entire .bank.in namespace. Scope: 1,393 unique .bank.in hostnames — built from prior DNS/CT logging, Wayback Machine CDX expansion, and HackerTarget subdomain enumeration. Every major bank, cooperative bank, payments bank, and DCCB with a .bank.in domain was covered. ...