Block public access to .git directories and version control files

Publicly accessible .git directories expose your site's complete version control history, potentially including genuine sensitive information that was ever committed to the repository, even information later removed from the current codebase — version control systems typically retain full historical records, meaning past mistakes remain accessible even after being "fixed" in the current version.

This exposure provides an attacker with significantly more than just your current source code — the complete commit history often reveals development patterns, potentially exposed credentials from earlier, less careful commits, comments discussing known vulnerabilities or planned fixes, and other genuinely sensitive information never intended for public access.

The common cause of this exposure mirrors the .env file issue discussed elsewhere — version control directories intended purely for development and deployment processes end up within the publicly accessible web root due to deployment configuration oversights, making them directly downloadable by anyone aware of or probing for this common misconfiguration.

Remediation requires both closing the immediate exposure and, genuinely importantly, reviewing what sensitive information might have been exposed throughout your repository's full history if this vulnerability existed for any meaningful period — any credentials or sensitive data ever committed to the exposed repository should be considered compromised and rotated, regardless of whether they remain in the current codebase.