Critical Vulnerability: .git Repository Exposure Found onhttps://ontobee.org

[Secure Exploit]

Severity: High
Bug Name: Exposed .git Repository

Website: https://ontobee.org
Affected POC: https://ontobee.org/.git/HEAD

Description:
Your publicly accessible .git directory exposes your entire source code, commit history, and potentially sensitive configuration data. Attackers can extract this information to identify vulnerabilities, secret keys, or backdoors, enabling a severe breach of your application and intellectual property.

Impact:

• Source code leakage with sensitive data exposure.

• Facilitation of targeted attacks based on revealed code.

• Intellectual property theft and reputational damage.

Suggested Fix:

• Block public access to .git directories by configuring your web server.

• Regularly audit repository commits to avoid sensitive data exposure.

• Consider removing .git directory from production environments entirely.

White Hat Note:
We disclose such risks to help you protect critical assets. Please notify us after fixing so we can verify and acknowledge your security focus with a bounty.

[He, Oliver]

Dear Sir/Madam,

 

Thank you for your responsibly disclosing the vulnerability. We take such reports seriously.

 

We have promptly investigated and removed the .git directory from the production environment to prevent further exposure.

 

We will continue to audit our deployment process to ensure this and similar misconfigurations do not recur.

 

Sincerely,

Oliver

 

 

From: ontobee...@googlegroups.com <ontobee...@googlegroups.com> On Behalf Of Secure Exploit
Sent: Wednesday, June 25, 2025 10:21 AM
To: ontobee...@googlegroups.com
Subject: Critical Vulnerability: .git Repository Exposure Found onhttps://ontobee.org

 

External Email - Use Caution

--
You received this message because you are subscribed to the Google Groups "Ontobee-discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ontobee-discu...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ontobee-discuss/CANKQG23-pkzz_OpLKuWiYNwgELSWrRjc23o6Cuw0%2BWP5msmX0A%40mail.gmail.com.

**********************************************************
Electronic Mail is not secure, may not be read every day, and should not be used for urgent or sensitive issues