Fix today

Your site's source code folder is downloadable

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

https://yourbakery.com/.git/HEAD is publicly readable. It can contain your whole code history, sometimes including passwords.

Why it matters

Attackers download it to find weaknesses and secrets at their leisure.

How to fix it

Ask your developer to block access to the .git folder today, then check the history for any secrets and change them.

For your developer