Question

git is a very powerful tool, but not that easy to use

For example, I am glad to use git as a tool to update my remote site from my git repository. The problem is there is a .git directory at the root of my website, external users can simply visit it using site/.git, that is terrible, since they can easily get my code history, and basically the current code, they can even get passwords and private informations from the configuration files.

So what is the right way to use git which can make full use of git, but without introducing these threats?

Using git clone git://repo site_root to initialize web site, and git pull to get changes is of great convenience, but also brings huge security problems.

Is there any methods that can be as convenient as the steps shown above, but without security pitfalls?

Answer 1

Well, I’m not really fond of using directly git to automatically deploy the last version of your code, but that’s another question.

Regarding your security issue, a really basic solution would be to just remove access to your .git file (with htaccess files?).

Another thing would be to remove your passwords from the git repository, there is probably no use of then in your version control system.