2026-11-10 · Daily security tips

Is a GitHub token sitting in your site's .git/config?

If you cloned with a token in the URL (https://user:ghp_xxx@github.com/...), Git saves that URL in .git/config. If the .git folder is uploaded with your site, anyone can fetch that file, and the token can open your code and maybe more.

Check: run curl -s https://yourapp.com/.git/config. A 404, or your normal HTML page, is fine. If you see [remote "origin"], the folder is public. Look at the url line for anything between https:// and @.

Fix: revoke that token on GitHub first. Then remove or block /.git on the host, and deploy only the build output (dist, .next), not the whole project folder. Locally, switch the remote to SSH or a credential helper so the token is not stored in the URL.