Checks

Exposed Git metadata

/.git/HEAD returned a refs/heads line, or /.git/config looked like a git config.

In plain language

The site served a Git metadata file.

An exposed .git directory lets someone reconstruct the repository, including history and deleted secrets.

A generic fix prompt

Paste this into your coding agent, or apply it by hand:

Block requests to /.git on the host. If the directory was downloadable, rotate secrets that have ever been committed and assume the source is public.