The Folder That Quietly Hands Out Your Entire Commit History

This is one of the checks in Harbova's free scan, and one of the more surprising ones the first time someone sees it flagged: a publicly reachable .git folder sitting at the root of a live site, quietly exposing far more than most people realize is there.

What's actually inside a .git folder

Git, the version control system almost every one of these apps is built with, stores the entire history of a project inside a hidden .git folder: every commit ever made, every previous version of every file, including versions that were later deleted or replaced. If that folder ends up reachable over the web, at an address like yoursite.com/.git/, the entire history it contains becomes downloadable by anyone who knows, or guesses, that it's there.

Why old history is worse than it sounds

A key or password that was accidentally committed and later removed from the current code often isn't actually gone, it's still sitting in an earlier commit, inside that same history. Someone who downloads the full .git folder can walk backward through every past version of every file, including the one where a secret was briefly hardcoded before someone noticed and fixed it forward. Removing something from today's code doesn't remove it from yesterday's commit.

Why this happens

It usually comes down to how the app is deployed: if the deployment process copies the entire project folder, including the hidden .git directory, to the location the web server actually serves files from, that folder becomes reachable the same way any other file in that directory would be. It's rarely intentional, it's a deployment configuration detail that's easy to overlook, especially when a project was set up quickly and just needed to go live.

How to check for this on your own app

• Try visiting your own site's address followed by /.git/HEAD or /.git/config directly in a browser.
• If you get a readable file back instead of an error page, your .git folder is exposed.
• The same check applies to /.env, /.env.local, and similar configuration files, which is why Harbova's scan checks all of them together.

The fix

Your web server's configuration needs to explicitly block public access to hidden folders and files, .git included, so they exist on the server but are never served to a browser request. And if a real secret genuinely was committed to that history at any point, the fix isn't just removing the folder from public access, it's rotating that specific secret immediately, since the history containing it may already have been downloaded before you noticed.

Related reading

• The Comment Box That Can Run Code in Someone Else's Browser
• The Bug Where Filling Out a Normal Form Can Quietly Make You an Admin
• The Vulnerability That's Just Changing a Number in a URL