« first day    last day (16 days later) » 

haykam
haykam
12:37 AM
 
 
4 hours later…
JonJonCS
JonJonCS
4:10 AM
Hey guys... Good news. The own hacker told us how he get the credentials.
Basically he searches for .git/config on Google getting a lot of user and pass to change the repos. Check your www.yoursiteurl.com/.git/config
 
 
2 hours later…
Marcus Nyberg
Marcus Nyberg
6:18 AM
@JonJons Thanks! Yes they are scanning for public .git folders on servers. That was my case and now I disabled that in apache. This happens when you clone your repos to your server.
 
 
3 hours later…
Anonymous
9:23 AM
Basically when you clone them the wrong way. Still, the config does not contain credentials by default.
 
Anonymous
Also see stackoverflow.com/questions/5343068/…. Use the secure way. Also you can use another directi'ory for .git and the files.
 
Anonymous
But it's often better to use a deploy key with read only rights.
 
Anonymous
 
Anonymous
Because you might have more directories like this eg .svn and so on.
 

« first day    last day (16 days later) »