.git directory public

A publicly reachable .git directory exposes not just the current code but the entire history. Everything ever committed and later deleted — keys, passwords, internal notes — remains reconstructable from it.

That is exactly why it is more dangerous than it looks: many teams delete an accidentally committed secret in the next commit and consider the matter closed. It stays in the history, and with an open .git directory anyone can read it out.

You can check it yourself: request your-domain.com/.git/HEAD. If you get a line like “ref: refs/heads/main” instead of an error page, the directory is open. Fix: exclude .git from deployment and rotate every credential that was ever committed.