https://frankenphp.dev/docs/

docker run -v $PWD:/app/public \ -p 80:80 -p 443:443 -p 443:443/udp \ dunglas/frankenphp

This mounts the current working directory into "public". Meaning, all .git, .env etc. will be publicly accessible.

Better form would be to mount a $PWD/src directory instead. The documentation needs to be updated better for newbies. Generally ill-advised. Documentation just needs better updating or warnings. Very dangerous to inexperienced devs.

In comparison the Laravel integration, it instructs the following:

https://frankenphp.dev/docs/laravel/

docker run -p 80:80 -p 443:443 -p 443:443/udp -v $PWD:/app dunglas/frankenphp

While all the sensitive files are mounted in, they have to be to function properly. In this case, they're mounted to a more secure context.