If the developer forgets to remove the built in controller welcome.php it helps the attacker to identify that the site is built with Codeigniter

How it was found

The attacker can check the website's backend technology simply by typing site_name/index.php/welcome/index it will display the codeigniter welcome page if the developer dosen't removed the built in controller and view welcome.php and welcome_message.php i attaching a screenshot below as a proof of concept