@JonJons Thanks! Yes they are scanning for public .git folders on servers. That was my case and now I disabled that in apache. This happens when you clone your repos to your server.
3 hours later…
Anonymous
9:23 AM
Basically when you clone them the wrong way. Still, the config does not contain credentials by default.