diff --git a/.htaccess b/.htaccess
index 8ce84d4..8dde019 100644
--- a/.htaccess
+++ b/.htaccess
@@ -7,3 +7,8 @@ RewriteEngine On
 RewriteRule ^db\.php$ - [F,L]
 RewriteCond %{REQUEST_URI} ^/db\.php$
 RewriteRule .* - [F,L]
+
+# .git/ was found directly downloadable (leaked GitHub PAT) - same class of
+# issue found and fixed on sibling sites this session.
+RewriteCond %{REQUEST_URI} ^/\.git
+RewriteRule .* - [F,L]