Git Exposed

Exposed Git repositories represent one of the most critical and frequently discovered vulnerabilities in web application security. When developers accidentally deploy their .git directory to a production web server, they expose the entire version control history of their project - including source code, configuration files, commit messages, and potentially sensitive credentials like API keys and database passwords.

What Is a .git Directory?

Git stores all repository metadata and history in a hidden .git folder at the root of every project. This directory contains the complete object database (all file versions and commits), branch references, configuration settings, and the staging index. When this folder is accessible on a live web server, anyone can reconstruct the full source code and review every change ever made to the project.

How Git Repositories Get Exposed

This vulnerability typically occurs through deployment mistakes. Common causes include copying the entire project directory (including .git) to the web server via FTP or rsync, using git clone directly in the web root, misconfigured CI/CD pipelines that include version control directories in build artifacts, and Docker containers that bundle the .git folder. Many popular web servers like Apache and Nginx do not block access to dotfiles by default, making the exposure immediately exploitable.

Real-World Impact of Exposed Git Repositories

Security researchers and bug bounty hunters routinely discover exposed Git repositories on Fortune 500 websites, government portals, and financial platforms. The consequences are severe: attackers can download the complete codebase, mine commit history for accidentally committed passwords and API tokens, discover internal architecture details, and identify additional vulnerabilities in the source code. Even credentials that were deleted in later commits remain recoverable from Git history.

Detection and Prevention

Organizations can prevent this vulnerability by configuring web servers to deny access to .git directories, using build pipelines that create clean deployment artifacts without version control metadata, and regularly scanning production servers with automated tools. Understanding how exposed Git repositories work and how attackers exploit them is essential knowledge for penetration testers and anyone responsible for securing web infrastructure.