- 168 of 200
- Security & Infrastructure
- Server, DNS & File Exposure Security
- High
Short answer: if you deploy by copying a Git repository onto your server, its hidden .git folder can end up public. From it, someone can rebuild your whole source code and its history, including any passwords ever committed. Check 168 tests for it in the full audit.
What Crawl Audit checks
- It runs only in the full audit, and only when the site owner has agreed to it. The free check shows that it runs in the full report.
- It requests
/.git/HEAD, a small file every repository has. - Fail: it loads (a 200 or 300-range response).
- Pass: it doesn't.
It looks at the response code only. If your site answers every address with a page instead of a 404, this can fail by mistake. Open the address: a real exposed file is one short line starting ref:.
What the sources say
- Git: the .git directory "is where almost everything that Git stores and manipulates is located." Copying it "gives you nearly everything you need" to rebuild the repository.
- Sysdig, October 2024: a campaign it named EMERALDWHALE targeted exposed Git configurations, "resulting in more than 15,000 cloud service credentials stolen." The attackers' tool found "more than 67,000 URLs with the path /.git/config exposed."
Fixing it
- Deploy built files only, not the repository.
- Block dot-folders at the server. In nginx:
location ~ /\.git { deny all; } - If it was exposed, assume the history was copied: rotate every secret that ever appeared in it, then remove the folder.
On devmarde.com
Our site is built and deployed by Vercel. /.git/HEAD returned a 404 on 6 October, so it passes.
Sources
- Git, Git Internals: Plumbing and Porcelain.
- Sysdig, EMERALDWHALE (30 October 2024), checked 6 October 2026.
See how your site does on every check.
Crawl Audit runs this check and 199 others on your domain. The full report is $7.89, one time. The free check on this site covers 25.