---
id: ebb9556e-9e38-4ba0-8081-2b71e45cd51e
title: repo.git publishes local filesystem path in config
state: closed
labels:
- security
assignees: []
milestone: null
created: 2026-10-27T14:47:50.464582699Z
updated: 2026-10-27T15:53:18.628243968Z
---
`dist/repo.git/config` is published and contains the builder's absolute filesystem path.

```
$ curl -s http://127.0.0.1:39313/repo.git/config
[core]
	repositoryformatversion = 0
	filemode = true
	bare = true
[remote "origin"]
	url = ~/src/code/gl0w-w0rld/hu13
```

`git clone` records `remote.origin.url` pointing at the source path, and every file under `repo.git/` is served verbatim. That leaks the deploy host's directory layout and username (``/home/<user>/src/...``) to the public.

Also published and useless: `description` (the "Unnamed repository" stub) and 14 `hooks/*.sample` files.

Fix, after the clone:
- `git --git-dir=<dest> config --remove-section remote.origin` (or build the export from the bundle without a named remote and never clone from the path)
- delete `description`, `hooks/`, `info/exclude` before `update-server-info`

Acceptance:
- [ ] built `repo.git/config` contains no `remote` section and no absolute path
- [ ] test: build fixture in a temp dir, assert `config` does not contain the temp dir path
- [ ] `hooks/` and `description` are absent from the export