From 8ad58278d047170ed7ba9e2017a92b3ff313c6ca Mon Sep 17 00:00:00 2001 From: Myron Blair Date: Sat, 4 Jul 2026 14:17:35 -0500 Subject: [PATCH] Block public access to .git directory (leaked live GitHub PAT) The docRoot is the git working tree, so .git/ was directly downloadable over HTTPS (curl https://orbis.orbishosting.com/.git/config returned 200), exposing the origin remote URL with an embedded GitHub personal access token in plaintext. Added a .htaccess denying dotfiles/.git and a matching OpenLiteSpeed vhost context as defense in depth. The exposed token should be revoked/rotated on GitHub regardless of this fix. --- .htaccess | 9 +++++++++ config/vhost/vhost.conf | 5 +++++ 2 files changed, 14 insertions(+) create mode 100644 .htaccess diff --git a/.htaccess b/.htaccess new file mode 100644 index 0000000..891814e --- /dev/null +++ b/.htaccess @@ -0,0 +1,9 @@ +# Block direct web access to the .git directory and other dotfiles. +# The .git folder lives inside public_html (docRoot) and was found to be +# directly downloadable over HTTPS (e.g. https://orbis.orbishosting.com/.git/config), +# which leaked a live GitHub personal access token embedded in the remote URL. +RedirectMatch 404 /\.git + + + Require all denied + diff --git a/config/vhost/vhost.conf b/config/vhost/vhost.conf index bb65144..75bd31d 100755 --- a/config/vhost/vhost.conf +++ b/config/vhost/vhost.conf @@ -62,6 +62,11 @@ rewrite { autoLoadHtaccess 1 } +context /.git { + location /dev/null + allowBrowse 0 +} + context /.well-known/acme-challenge { location /usr/local/lsws/Example/html/.well-known/acme-challenge allowBrowse 1