snag.page

Every check ยท Exposed files

Git repository

exposure/git

What it checks

/.git/HEAD, /.git/config

Why it matters

Anyone can download the site's source code and its whole history from /.git/.

How to fix it

  1. Block every path that starts /.git in the web server.
  2. Deploy without the .git folder, for example by building into a separate folder.
  3. Treat every password or key ever committed to the repository as public, and change it.

Check a site for this and everything else: snag.page. More on exposed files: Exposed files Keys in scripts Environment files wp-config.php copies Database dumps AWS and npm credentials Private SSH keys Editor upload settings Spring Boot actuator Terraform state Git credentials Kubernetes config phpinfo() pages Debug panels Subversion and Mercurial Backup archives Password files PHP error logs Laravel logs ELMAH error logs Database admin pages Apache server-status Go's pprof docker-compose.yml Directory listings .DS_Store files WordPress users