Re:Pear.php.net shuts down after maintainers discover seriou...
by meowface on Thursday January 24, 2019 @11:44AM
(#18990282)
Probably preaching to the choir here, but for those who are unaware, be sure that .git directories are not accessible by web clients. It will lead to source code disclosure, and if you've checked in any secrets, credential exposure as well.
[ Parent
| on HN ]
Re:Pear.php.net shuts down after maintainers discover seriou...
by aaronmdjones on Saturday January 26, 2019 @01:27PM
(#19007581)
That and if the webserver can write to .git it can also invisibly modify the history to ensure that you continue to check out the backdoored code no matter how far you go back.