Open yoursite.com/.git/HEAD in a browser. If it shows a line like ref: refs/heads/main, your site's .git folder is being served, and with it the repository's files and history. Block every folder starting with a dot, then check the history for passwords or keys and change any you find.
What's the problem
The .git folder, where git keeps your project's history, was deployed to the web server and can be read by anyone.
Why it happens
- The site was deployed by copying or cloning the whole repository into the public folder,
.gitincluded. - The server has no rule blocking files and folders that start with a dot.
How to fix it
- Check it: open
https://yoursite.com/.git/HEADandhttps://yoursite.com/.git/config. Text likeref: refs/heads/mainor[core]means it's exposed. - Block it now: deny every path starting with a dot in your web server (on nginx,
location ~ /\. { deny all; }). - Remove
.gitfrom the public folder, and deploy only the built files from now on. - Check the history for secrets. Anything ever committed, even if deleted later, may be readable. Change any password or key that was ever in the repository.
What Preventionlabs checks
One click runs the full report on your domain. For this problem it shows files that should never be public, such as .env and .git; script libraries on your homepage with published security holes; whether HTTPS works and http visitors are sent to it; whether your site loads, how fast, and where its redirects go. It checks from the outside, so it can't see files your server only uses internally.
Run your free reportYour first report is free, no card needed. Then A$50 a month, up to 10 domains. Read-only: it never changes anything.
Sources
- MITRE: CWE-527: Exposure of Version-Control Repository to an Unauthorized Control SphereCWE
The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.