Expected Findings
- Repository metadata is publicly readable.
- Origin URL and branch information are disclosed.
Repository Surface
Git Exposed
The public page immediately loads repository metadata, making it obvious that the `.git` directory is exposed over HTTP.
Repo probe
Primary Flows
- .git/HEAD Current ref
- .git/config Repository config
Signals
Origin
url = https://github.com/example/private-repo.git