Exposed .git folder: how to check and fix it
Open yourdomain.com/.git/config. If it shows settings instead of a 404 or your normal page, your repository may be downloadable, including its history and any secrets ever committed.
Why this happens
When a whole project folder is deployed, its hidden .git folder can come along. Free tools can rebuild a project from it, so one old commit can expose a key you removed months ago.
How to check
- Run these on your own domain:
curl -i https://yourdomain.com/.git/config curl -i https://yourdomain.com/.git/HEAD - Text such as [core] or ref: refs/heads/main means it's exposed.
- Look through your history for secrets:
git log -p | grep -E "sk_live_|sk-proj-|service_role|PASSWORD"
How to fix it
- Deploy only your build output, not the project folder.
- Block paths that start with a dot on your server.
- Replace every secret that's in the history.
- Remember that rewriting history doesn't help if a copy was already taken.
Prompt for your AI tool
Check how this app is deployed and make sure .git and other dotfiles are never served. Change the deploy to publish only the build output, then show me how to confirm it on the live site.
Review what your AI tool changes, and test the live site afterward.
Catch this before a stranger does
AppLeakWatch keeps checking your live app and emails you when something new appears.
Start your 7-day trialCommon questions
Is my code really at risk?
If the folder can be downloaded, assume your code and history can be rebuilt.
Do hosted platforms have this problem?
Many deploy only build output, but check your own site, because setups vary.