If I checkout a working copy into the www root of my site, would that be a security vulnerability?

  • i would block access to your .git directory just to be on the safe side.. – Doon Jun 11 '15 at 0:41
  • In a word: Yes. It's a bit like leaving your car unlocked, it's not a problem until someone notices and opens the door to see what they can find/do... – AD7six Sep 8 '15 at 10:03

Not directly.

Assuming your code is properly written, and written securely, and you never checked in sensitive details (passwords and keys!); then disclosing the .git folder and your source code wouldn't create any security vulnerability that wasn't there in the first place. However, having access to your source code makes it easier for an attacker to search for an actual vulnerability; and you probably do not want to make life easier for the attacker.

Additionally, the attacker might be able to obtain a copy of the source code, which may be an intellectual property issue, but that's not really a security issue.

Just make sure that your .git directory isn't accessible from an HTTP request, and you should be golden.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.