From ffebe872100236c1bebdf86829d45f99850ca58a Mon Sep 17 00:00:00 2001 From: Myron Blair Date: Sat, 4 Jul 2026 16:04:05 -0500 Subject: [PATCH] Block public access to .git directory (leaked GitHub PAT, same issue found on sibling sites) --- .htaccess | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.htaccess b/.htaccess index 8ce84d4..8dde019 100644 --- a/.htaccess +++ b/.htaccess @@ -7,3 +7,8 @@ RewriteEngine On RewriteRule ^db\.php$ - [F,L] RewriteCond %{REQUEST_URI} ^/db\.php$ RewriteRule .* - [F,L] + +# .git/ was found directly downloadable (leaked GitHub PAT) - same class of +# issue found and fixed on sibling sites this session. +RewriteCond %{REQUEST_URI} ^/\.git +RewriteRule .* - [F,L]