Question

I’m wondering if it’s okay keep the .git directory in the web root for a web site.

The permissions of the .git folder and subfolders is 775 and the file are 644.

I suppose I could just set zero permissions for the “others” so that they’d also get access denied?

Thanks

Answer 1

You should put a .htaccess file in the .git directory containing the following:

Order deny,allow
Deny from all

this way, no one can access the directory.

In general, there is no answer if it is ok or not. If you are making your project open source anyway than there’s no real problem with that. But if it is a private project than somebody could take advantage of the object-directory to get hold of your source codes