An administrator forgets to disable "Directory Browsing" in the server settings.

Developers may accidentally sync their private .ssh folders or password managers to a public-facing web directory using FTP or Git.

Usually an index.php or index.html page.