When you use Git to manage your code, Git creates a hidden .git directory in your project folder. This folder contains your entire version history, commit messages, branch names, and configuration. It belongs on your server — not on the open web.
If your web server serves the .git folder publicly, an attacker can reconstruct your entire source code.
What's inside
The .git directory contains:
- Every version of every file ever committed
- Commit messages (often referencing internal systems, bugs, or security fixes)
- Author names and email addresses
- Remote repository URLs
- Configuration files that may include credentials or tokens
Using freely available tools, an attacker can download the .git folder piece by piece and reconstruct your complete codebase — even if the directory itself isn't browsable.
Why this is serious
Source code access gives an attacker:
- Hardcoded secrets — API keys or passwords developers left in the code
- Application logic — knowledge of how your app works, making exploits far easier to find
- Internal architecture — server names, database schemas, third-party integrations
How to fix it
Nginx:
location ~ /\.git {
deny all;
}
Apache (.htaccess):
RedirectMatch 404 /\.git
Then audit your repository history for any committed secrets and rotate them immediately — the history is the risk, not just the current files.
threatprobe.app's free scan checks for exposed .git folders and dozens of other sensitive paths.