Git Repository Secrets Exposure
Exposed .git directories allow attackers to download the entire repository including git history. Secrets committed and later "deleted" remain in the git history forever.
Overview
Git repositories contain complete project history including all committed secrets. Exposed .git directories on web servers allow attackers to reconstruct the entire repository using tools like git-dumper. Even secrets that were "deleted" in later commits remain accessible in git history.
Types & Variants
.git Directory Exposure
Web server serving .git folder contents.
Historical Secrets
Credentials committed in the past, even if later removed.
Public Repo Secrets
Accidentally pushing secrets to public GitHub/GitLab repos.
Impact
Source code theft, credential exposure, API key compromise, intellectual property leak.
Examples
Git Dump Command
git-dumper https://target.com/.git/ ./output git log --all --pretty=format:"%H" | xargs git show | grep -E "(password|secret|key)"
Remediation
Block .git access at web server level. Use git-secrets or detect-secrets pre-commit hooks. Rotate all exposed credentials immediately.
Block .git access: location ~ /\.git { deny all; }
Use pre-commit hooks (git-secrets, detect-secrets)
Scan repos with trufflehog or gitleaks
Rotate exposed credentials immediately
Related SuperClue scanner checks
These scanner checks look for signs of Git Repository Secrets Exposure. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works