Glossary › Patterns › Code / repository leak
Reference · Pattern

Exposed .git directory on a production web server

Severity CriticalKind Code / repository leakEffort to fix TrivialUpdated 7 Oct 2026By LeakTrace
Definition

A production web server exposes its `.git/` directory over HTTP, allowing anyone to reconstruct the full source tree, including secrets committed to history.

What it is

When a codebase is deployed to a web server by cloning or pulling a git repository into the document root, the .git/ directory ends up publicly accessible unless the web server is explicitly configured to block it. Anyone who requests https://<domain>/.git/config and gets a 200 response can then use standard tooling to reconstruct the entire source tree, commit history, and any secrets that were ever committed and later removed.

Why it matters

Reconstructed source often contains database credentials, API keys, third-party integration tokens, and unsanitized customer data used in test fixtures. Even a "clean" current head can have secrets in history that a rotation swept from the working tree but not from the git objects.

The check behind the finding

curl -sI https://yourfirm.ca/.git/HEAD

A 200 response means the folder is readable from outside. It should be 403 or 404.

Closing it

This can be closed quickly. Any key or password that was ever in the code has to be treated as known, whether or not it is still there today. The assessment gives the exact steps, in order.

The outside watch for your firm: see what is open before anyone else does, with the proof for the lead finding. Check my firm →