Git metadata signature is publicly served
ShipReady found a recognised Git metadata signature at one of two fixed .git probe paths.
Why it matters
Unintended source-control metadata exposure should be reviewed and removed from public deployment output.
How ShipReady detects it
What it inspects
ShipReady probes only /.git/HEAD and /.git/config on an eligible origin response.
What triggers a finding
A finding requires HTTP 200, the expected ref: or [core] signature, and no SPA catch-all signature.
What the evidence shows
At least one reported fixed path returned a supported Git metadata signature.
Limits of this check
ShipReady does not reconstruct a repository, retrieve history, inspect commits, locate credentials, or prove that a complete .git directory can be downloaded.
How to fix it
Keep repository metadata outside the web root
Review the deployment document root and build-copy rules so the repository’s .git directory is never included in publicly served output.
Remove the exposed Git metadata
Remove the unintended public artifact and correct the deployment configuration rather than relying on the obscurity of the .git path.
How to verify the change
Recheck the reported Git metadata path
After deployment, request the reported /.git/HEAD or /.git/config path and inspect the release artifact boundary.
Expected: The reported path no longer returns the supported Git metadata signature.