It's right at the start of the post - the git remote including credentials was exposed via the .git directory