myron/orbishosting
1
0
Fork 0
mirror of https://github.com/myronblair/orbishosting synced 2026-07-27 12:54:46 -05:00
Code Issues Packages Projects Releases Wiki Activity
7 Commits 1 Branch 0 Tags
main
Commit Graph

7 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
myron 013b878b87 security: block public access to .git, legacy, dist, extensions, config dirs 
Live server audit found orbishosting.com/.git/config directly downloadable
over HTTPS, exposing a plaintext GitHub PAT in the remote URL (docroot ==
git working directory, no deny rule existed). Also found the legacy
SugarCRM install under public_html/legacy (gitignored, not part of this
repo) publicly reachable via /legacy/index.php etc.

Adds a docroot .htaccess (LiteSpeed honors rewrite-based deny rules per
vhost.conf autoLoadHtaccess=1) to 403 all of these paths. This closes the
HTTP exposure only — the leaked GitHub token itself still needs to be
revoked/rotated on GitHub, this fix cannot do that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-04 14:18:51 -05:00
myron 15bf427c2f fix: correct repoMap for orbishosting repos, fix DEPLOY_LOG path, remove dead __NOVACPX_VM__ branch, dedupe date() call, fix syntax error in define 2026-06-23 16:35:22 +00:00
myron 72135136b7 sync: updated homepage, assets, robots.txt, sitemap, deploy webhook 2026-06-21 03:46:46 +00:00
myron 7d8fc5bec3 Add SEO meta tags and replace CyberPanel placeholder with branded homepage 2026-06-09 22:30:48 +00:00
myron 718c9c7efe Add vhost config 2026-05-25 13:51:57 +00:00
myron 714025ab23 Add legacy/ and dist/ to .gitignore (runtime dirs) 2026-05-25 13:24:37 +00:00
myron 47491a5a87 Initial commit 2026-05-22 12:52:47 +00:00