Git version control is now standard practice in almost every web project and environment (including production). Git always creates a subdirectory called `.git` , and if this is located at the same level as the website's public directory, sensitive files can be accessed publicly (for example, accessing `/.git/logs/ HEAD` displays the latest commits). This guide explains in detail how to clone another Git repository even without a directory listing.
To prevent this, in the case of an Apache server, you restrict access to the entire .git folder in the .htaccess file and issue a 404 error, so the attacker does not know that the folder exists:
32b39d7c9836a649597019300a5c2115
If you have an NGINX server running, these rules will do.:
32b39d7c9836a649597019300a5c2115