Sign in Subscribe
By E. Kohler in Security —

Massive Secret Exposure: The .git Directory Security Crisis at Popular Websites

Massive leaks of secret data through publicly accessible .git directories on thousands of popular websites reveal a widespread, fundamental vulnerability in modern software development infrastructure. Thousands of high-traffic websites made their .git directories accessible on the web, exposing large volumes of verified, production secret data, including AWS keys, GitHub tokens with admin rights, and database credentials. This has far-reaching consequences for software supply chains and enterprise security, and highlights the prioritisation of speed over security in many DevOps environments.

The .git Directory: Structure, Significance, and Security Implications

The .git directory is the hidden core of a Git repository and contains all information needed to manage the repository. It is created automatically during initialisation and stores the commit history, branches, configuration, and references of the project. Key components include:

  • .git/config with repository-specific settings, including information for remote repositories.
  • .git/objects with all versions of every file ever committed.
  • .git/refs with references to branches and tags.

If this directory is publicly accessible, an attacker can reconstruct the complete development history, including older code versions, commit messages, and metadata. Especially critical: old commits containing secrets accidentally committed in the past (API keys, database passwords) often remain permanently retrievable in the .git directory.

If attackers gain access to the .git directory, they can use specialised tools to download and reconstruct the structure locally. Tools like GitTools/GitDumper enable automated downloading of an exposed repository. Even if directory listing is disabled, the standardised .git structure can be reconstructed automatically.

Unprotected .git Directories: A Widespread Phenomenon

In a 2022 nationwide survey, the Swiss NCSC found around 1,300 systems with publicly accessible .git directories, through which source code, credentials, or passwords were visible.

In Germany, a scan by the German Society for Cybersecurity showed: of nearly seven million websites, almost 25,000 domains and more than 40,000 subdomains were affected. The vulnerability has been known since 2015 and is easy to prevent, yet remains widespread globally.

Secret Leaks in a Broader Context: GitHub and Other Platforms

The .git exposure is part of a general secrets crisis on code platforms. GitHub reported over 39 million leaked secrets in 2024, a 67 percent increase year-on-year.

A central phenomenon is "zombie leaks": exposed but unrevoked secrets. More than 91 percent of leaked secrets were still active five days after the leak. Developers often only delete the commit or make a repository private, without revoking the keys or credentials.

Critical Analysis: Why Does a Website Expose Its .git Directories?

The exposure is mainly due to configuration errors and negligence:

  • Faulty deployment: The entire project directory including .git is uploaded to the web root.
  • Incorrect web server configuration: Directory listing is enabled and the .git directory is not explicitly blocked. An attacker can simply navigate to https://example.com/.git/.
  • Incorrect use of .gitignore: In rare cases, the .git directory itself is committed, for example through careless copying of existing project directories.

The NCSC emphasises that human errors by administrators and developers are the primary cause, for example through copying project folders without checking the data they contain.

The Multi-Dimensional Threat: From Source Code to Cloud Infrastructure

Exposed .git directories allow:

  • Theft of source code and trade secrets (algorithms, proprietary software).
  • Identification of vulnerabilities through analysis of history, commits, and dependencies.
  • Direct access to infrastructure via leaked passwords, API keys, and configuration files.

According to the NCSC, .git folders frequently contain both the complete source code and configuration files with sensitive system information. This allows attackers to search systematically for vulnerabilities and compromise applications or entire systems.

Remediation Strategies and Best Practices

Short-term measures:

  • Block access to .git: In Apache via rewrite rules or htaccess, in Nginx via a location block.
  • Disable directory listing:
    • Apache: Options -Indexes in htaccess.
    • Nginx: autoindex off;

Long-term measures:

  • Adjust the development process so that only necessary data ends up on web servers.
  • No secrets in source code, or at the very least consistently ignore sensitive files in the Git directory.
  • A well-maintained .gitignore with patterns for .env, secret files, and configurations containing secrets.

The NCSC points out that these basic best practices are frequently not implemented in practice.

Similar Risks: .env and .DS_Store Files

Alongside .git, the NCSC warns about unprotected .env and .DS_Store files.

  • .env often contains configuration and secrets via environment variables.
  • .DS_Store stores folder settings on macOS and can also expose sensitive information.

Implications for Security Strategy

The .git exposure is a typical problem of software supply chain security in fast-moving DevOps environments. Developers under time pressure neglect security guidelines; secrets are additionally exposed through personal GitHub accounts, forks, or supplier repositories.

The typical attack path:

  1. Access to an exposed .git directory on a website.
  2. Extraction of history and search for secrets.
  3. Use of discovered credentials, e.g. for cloud accounts.
  4. Listing of resources and exfiltration of sensitive data.

This can lead to full infrastructure compromise within minutes.

Conclusion

The widespread exposure of secrets via .git directories reveals structural deficiencies in development processes, security culture, and secrets management. An effective response requires:

  • Strict .gitignore and secrets strategies,
  • Consistent web server hardening,
  • and continuous scanning for exposed secrets and misconfigurations.

Organisations must adapt their development processes to ensure no sensitive data ends up in Git repositories.

Sources & References

Summarised with the help of AI.

Previous

CISA KEV Catalog: Actively Exploited Zero-Days in December 2025

 Next

Critical Zero-Day Vulnerability CVE-2025-20393 and CISA KEV

You might also like...