Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by noobx - 01.08.2026
Last edited by cbay - 01.08.2026

Title: Retrievable .git directory exposes source code of security.alwaysdata.
Severity: HIGH
Endpoint: https://security.alwaysdata.com/.git/config

Summary

---

An unauthenticated client can retrieve a sensitive artifact from security.alwaysdata.com. Verified live: HEAD → ref: refs/heads/master, index DIRC magic — full repo retrievable.

Steps to Reproduce

---

1. Fetch the resource without any credentials:

   curl -sk https://security.alwaysdata.com/.git/config

 Observed: HTTP 200, git config content returned.

2. Verify the sensitive content:

   curl -sk https://security.alwaysdata.com/.git/config | head -50

 Observed: HEAD -> ref: refs/heads/master, index DIRC magic — full repo retrievable.

3. No authentication or rate limiting was required for either request.

Impact

---

Full source code disclosure including configuration and commit history; eases discovery of higher-severity issues.

Remediation

---

1. Remove the file from the webroot and store backups/config outside the document root. 2. Deny direct web access to backup/config/log artifacts at the web server. 3. Rotate any credentials exposed in the artifact. 4. Review access logs for prior downloads.