.git directory exposed

Why it matters

An exposed .git folder lets anyone download your full source code and its history, including old secrets.

How to fix it

Stop deploying the .git folder (deploy build output only) and rotate any secret ever committed.

How we test it

Passive — runs in the free check, looks only at what a browser can see.