Guide · 2026-10-16

Exposed .git folder: why it's dangerous and how to fix it

Check

Visit https://yoursite.com/.git/config. If you see text starting with [core], your Git folder is public.

Why it matters

Free tools can rebuild an entire repository from a public .git folder: every file and every past commit. That includes any secret that was ever committed, even if you deleted it later.

Fix

1. Deploy only your build output, not the project folder.
2. If your server must serve the project root, block /.git with a deny rule in its configuration.
3. Rotate every secret that has ever appeared in the repo's history.