Common problem

Is your .git folder open to the public?

The .git folder holds your project's history. If your host serves it, tools can often rebuild your source code, including any secret that was ever committed.

Check your live app for free

Paste your link. The free summary usually takes under a minute.

How it happens

The whole project folder gets deployed, instead of only the build output.

The host has no rule to block paths that start with /.git.

What our scan checks

  • We ask for /.git/config. If it opens and looks like a git config file, we flag it.
Example fix prompt

Fix prompt from a full report

Paste this into your AI builder
In my AI app builder (Lovable, Bolt, Cursor, Replit, v0 or similar):
My /.git folder is publicly served.
1. Remove the .git folder from what my host serves (deploy the build output only).
2. Add a rule to block every path that starts with /.git.
3. Check my git history for secrets; I will rotate any I find.

The full report gives a prompt like this for every issue it finds, written for your site.

This is an automated, surface-level check of what your site shows the public. It is not a full security audit.