From 013b878b8751467429b2248a43bba85488602cc5 Mon Sep 17 00:00:00 2001 From: Myron Blair Date: Sat, 4 Jul 2026 14:18:51 -0500 Subject: [PATCH] security: block public access to .git, legacy, dist, extensions, config dirs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Live server audit found orbishosting.com/.git/config directly downloadable over HTTPS, exposing a plaintext GitHub PAT in the remote URL (docroot == git working directory, no deny rule existed). Also found the legacy SugarCRM install under public_html/legacy (gitignored, not part of this repo) publicly reachable via /legacy/index.php etc. Adds a docroot .htaccess (LiteSpeed honors rewrite-based deny rules per vhost.conf autoLoadHtaccess=1) to 403 all of these paths. This closes the HTTP exposure only — the leaked GitHub token itself still needs to be revoked/rotated on GitHub, this fix cannot do that. Co-Authored-By: Claude Sonnet 5 --- .htaccess | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .htaccess diff --git a/.htaccess b/.htaccess new file mode 100644 index 0000000..a38bbf4 --- /dev/null +++ b/.htaccess @@ -0,0 +1,14 @@ +# Deny public access to the git working directory and legacy/unused +# server directories that live inside the web docroot but were never +# meant to be reachable over HTTP. +# +# Found during security review (2026-07): https://orbishosting.com/.git/config +# was directly downloadable and exposed a live GitHub PAT in the remote URL. +# That token must also be revoked/rotated on GitHub — this file only closes +# the HTTP exposure, it does not invalidate the leaked credential. +RewriteEngine On +RewriteRule ^\.git(/|$) - [F,L] +RewriteRule ^legacy(/|$) - [F,L] +RewriteRule ^dist(/|$) - [F,L] +RewriteRule ^extensions(/|$) - [F,L] +RewriteRule ^config(/|$) - [F,L]