Git Directory Accessible via Web Server
What Is This Vulnerability?
When the .git directory is accessible through a web server, attackers can download the entire repository history, including source code, configuration files, and secrets that were committed at any point. Even files that were later deleted or overwritten in the repository remain in the Git history and can be recovered by the attacker.
Why It Happens
Web servers configured to serve static files from the project root will serve the .git directory by default unless explicitly blocked. This commonly happens with simple deployment methods like rsync or FTP that copy the entire project, including hidden directories. Docker builds that copy the full project context without a proper .dockerignore also include .git.
Example Code
server {
listen 80;
server_name example.com;
root /var/www/html;
location / {
try_files $uri $uri/ /index.html;
}
}server {
listen 80;
server_name example.com;
root /var/www/html;
location ~ /\.git {
deny all;
return 404;
}
location ~ /\. {
deny all;
return 404;
}
location / {
try_files $uri $uri/ /index.html;
}
}How Hackers Exploit It
Attackers check for /.git/HEAD on websites as a standard reconnaissance step. If accessible, they use tools like git-dumper to reconstruct the full repository. This reveals source code, hardcoded credentials, API keys, database passwords, internal documentation, and deployment scripts. Even previously deleted secrets are recoverable from commit history.
How to Fix It
Block access to all hidden files and directories (those starting with a dot) in your web server configuration. Add .git to your .dockerignore when building images. Use deployment methods that only copy built artifacts, not the entire repository. Regularly scan your public-facing servers for exposed .git directories using tools like git-dumper or nuclei.