myron 013b878b87 security: block public access to .git, legacy, dist, extensions, config dirs ...

Live server audit found orbishosting.com/.git/config directly downloadable
over HTTPS, exposing a plaintext GitHub PAT in the remote URL (docroot ==
git working directory, no deny rule existed). Also found the legacy
SugarCRM install under public_html/legacy (gitignored, not part of this
repo) publicly reachable via /legacy/index.php etc.

Adds a docroot .htaccess (LiteSpeed honors rewrite-based deny rules per
vhost.conf autoLoadHtaccess=1) to 403 all of these paths. This closes the
HTTP exposure only — the leaked GitHub token itself still needs to be
revoked/rotated on GitHub, this fix cannot do that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-04 14:18:51 -05:00

assets

sync: updated homepage, assets, robots.txt, sitemap, deploy webhook

2026-06-21 03:46:46 +00:00

config/vhost

Add vhost config

2026-05-25 13:51:57 +00:00

.gitignore

Add legacy/ and dist/ to .gitignore (runtime dirs)

2026-05-25 13:24:37 +00:00

.htaccess

security: block public access to .git, legacy, dist, extensions, config dirs

2026-07-04 14:18:51 -05:00

index.html

sync: updated homepage, assets, robots.txt, sitemap, deploy webhook

2026-06-21 03:46:46 +00:00

robots.txt

sync: updated homepage, assets, robots.txt, sitemap, deploy webhook

2026-06-21 03:46:46 +00:00

sitemap.xml

sync: updated homepage, assets, robots.txt, sitemap, deploy webhook

2026-06-21 03:46:46 +00:00

webhook.php

fix: correct repoMap for orbishosting repos, fix DEPLOY_LOG path, remove dead __NOVACPX_VM__ branch, dedupe date() call, fix syntax error in define

2026-06-23 16:35:22 +00:00

S

Description

Mirror of github.com/myronblair/orbishosting

71 KiB

Languages

HTML 65.3%

PHP 34.7%