Version control data is published with your app
Exposed version control metadata
What this means
The hidden folder your version control system uses was deployed together with the app and is readable over the web.
Why it matters
That folder often allows reconstructing your entire source code, including files you never intended to publish and credentials committed by mistake — even ones deleted later, because history keeps them.
When this is not a problem
For a repository that is public anyway the impact is limited to credentials that may sit in its history.
How to fix it
- Remove version control folders from the deployed application.
- Block them at the web server as a second line of defence.
- Rotate any credentials that ever appeared in the repository history.
Prompt for your AI agent
Exclude version control folders from deployment and block requests to them at the web server level.
How to verify the fix: request the version control folder — expect a refusal
References: cwe.mitre.org