---

id: ebb9556e-9e38-4ba0-8081-2b71e45cd51e title: repo.git publishes local filesystem path in config state: closed labels:

• security assignees: [] milestone: null created: 2026-10-27T14:47:50.464582699Z updated: 2026-10-27T15:53:18.628243968Z

---

dist/repo.git/config is published and contains the builder's absolute filesystem path.

$ curl -s http://127.0.0.1:39313/repo.git/config
[core]
	repositoryformatversion = 0
	filemode = true
	bare = true
[remote "origin"]
	url = ~/src/code/gl0w-w0rld/hu13

git clone records remote.origin.url pointing at the source path, and every file under repo.git/ is served verbatim. That leaks the deploy host's directory layout and username (/home/<user>/src/...) to the public.

Also published and useless: description (the "Unnamed repository" stub) and 14 hooks/*.sample files.

Fix, after the clone:

• git --git-dir=<dest> config --remove-section remote.origin (or build the export from the bundle without a named remote and never clone from the path)
• delete description, hooks/, info/exclude before update-server-info

Acceptance:

• built repo.git/config contains no remote section and no absolute path
• test: build fixture in a temp dir, assert config does not contain the temp dir path
• hooks/ and description are absent from the export