Hacker News Reader

In reality, it wasn't the attacker's incompetence, it was the hosting provider's fault (which is a "Serverless app platform" they use to deploy their phishing pages)

When you deploy a simple page with them it exposes .git/CONFIG and the x-access-token that grants access to the repository.

View on HN

Lacking details, but people don't generally rsync a checkout of a git repo (including a .git folder) to their webspace, so you're right if the hoster did that, I find it more likely the people did that.

On the other hand just blacklisting .git/* is not great, maybe I want to publish something on that path, just like any other filename. It's prone to lead to false positives.

Reply on news.ycombinator.com