Repository metadata served from a public web directory may disclose development information. The scanner checks supported public paths and records the observed response.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Requests /.git/config and /.git/HEAD and checks for Git file contents.
Block access to the .git directory on the web server and remove it from the deployed files. Rotate any credentials that were ever committed.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology