Exposed .git directory
The Git metadata for the project can be downloaded from the website.
Who this is for
Static deploys that uploaded the whole repository, including the .git folder.
What AppPulse does
We GET /.git/HEAD, /.git/config, and /.git/index. HTML error pages are ignored.
Why it matters
A public .git folder can be reconstructed into the source tree, including secrets that were committed and later deleted.
What to tell your AI tool
Block every path under /.git at the host and remove the folder from the artifact. Rotate anything that was ever committed.