git security

git-credential Risks: When Helpers Leak What They Cache

Post author:Prabhu Kalyan Samal
Post published:September 5, 2026
Post category:Cryptography & PKI Security Supply Chain Security

Git’s January 2023 advisory flagged plaintext credential stores and verbose logs echoing 2FA tokens. Developer tooling is production security surface.

Exposed git directory terminal session

The Exposed .git Mistake We Keep Finding After 10 Years

Post author:Prabhu Kalyan Samal
Post published:August 30, 2026
Post category:Security Web & API Security

One curl request to /.git/HEAD hands attackers your full source, every commit ever made, deleted files, and usually a working credential. A decade of research says this mistake is not aging out. Here is the exploit chain — and the three-layer fix.