Ideally the .git directory is not in production to begin with. as it is not needed to run an application. However, many deployment strategies use Git to move code changes onto a machine. If this is the case for your application; please, please, please do not allow .git to be accessible by the public. This situation is a MAJOR security risk. It could lead directly to a security breach.
- https://about.gitlab.com/2019/05/14/git-ransom-campaign-incident-report-atlassian-bitbucket-github-gitlab/
- https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/
- https://laravel-news.com/psa-hide-your-gitconfig-directory
- https://sweetness.hmmz.org/2013-06-10-devs-please-stop-serving-git-to-the-outside.html
