Guides / exposed .git directory

Exposed .git folder: anyone can download your source code

If /.git/config opens on your live site, your full source code and history can be downloaded. How to check and fix.

What it is

When the whole project folder is uploaded to a web server instead of just the build output, the hidden .git folder can go with it. Free tools can rebuild your entire repository from it, including every old commit. Old commits often contain keys you deleted later, so they are still exposed.

How to check

1. Visit https://yourapp.com/.git/config and /.git/HEAD. You should get a 404.
2. If either opens, assume the code and its history are public.
3. Or run a free Cobalt Owl scan, which checks these paths.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

My site serves the /.git directory, so anyone can download my source code and history. Make sure the deploy uploads only the build output folder (for example dist/), never the repo root, and configure the server to deny access to /.git and other dotfiles. Then help me search the git history for committed secrets so I can rotate them.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• OWASP WSTG: Review old, backup and unreferenced files
• Git: gitignore

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.