Git Repository Exposure
Accessible .git directories on web servers allow attackers to download the entire repository including source code, commit history, branches, configuration files, and potentially hardcoded secrets from the version history.
Overview
When a .git directory is accessible on a production web server, attackers can reconstruct the entire repository including all source code, commit history (which may contain removed secrets), branch information, and contributor details. This is a common misconfiguration that occurs when deploying directly from a Git repository.
Impact
Complete source code disclosure, secret extraction from commit history, intellectual property theft, accelerated vulnerability discovery.
Examples
Git Directory Access
curl https://example.com/.git/HEAD => ref: refs/heads/main curl https://example.com/.git/config => [remote "origin"] url = git@github.com:company/private-repo.git
Remediation
Block access to .git directories in web server configuration, use .gitignore properly, never deploy from git clone, and scan for exposed .git directories.
Block access to .git in web server configuration
Use proper deployment pipelines (don't deploy via git clone)
Add server-level rules to deny access to hidden files/directories
Regularly scan for exposed .git directories
Related SuperClue scanner checks
These scanner checks look for signs of Git Repository Exposure. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works