Bolt
Exposed git metadata on a Bolt app
Bolt serves a live preview from the project you are editing. That preview is a public address. Code that looks private in the editor is still in the script the preview downloads.
A public .git directory on the deployed host.
What the scan can see
/.git/HEAD and /.git/config are fetched once each. A real git response is critical. The report can name the remote host. It does not keep the remote username or token. An HTML shell is ignored.
What it does not do
This is not a clone of the repository and not a history dump. Other git paths are not requested.
The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
What to do next
Stop serving .git. If a token was in the remote URL, revoke it. Treat the repo as copied if HEAD was public.
Questions
Does this open my Bolt project?
No. The scan does not sign into Bolt or read the editor. It only requests the URL you paste and a short, fixed list of paths on that host.
Can the scan prove exposed git metadata is fully fixed?
This is not a clone of the repository and not a history dump. Other git paths are not requested.
What should I do if the scan finds it?
Stop serving .git. If a token was in the remote URL, revoke it. Treat the repo as copied if HEAD was public.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.