Hacker News Reader

No, you need to delete the .git folder from your server entirely. Ideally, delete it before you deploy. In fact, don't even put a github deploy key on the server. Deploy binaries.

And don't just stop with .git: Delete any folder/file that's not required to operate the app in production.

View on HN

Yup. I used to host .git on a server but it ended up being more complication than it was really worth. Now I just have a “deploy” script that uses sftp to push all the build artifacts (and nothing else) to the server.

Now I just have a “deploy” script that uses sftp to push all the build artifacts (and nothing else) to the server.

We do something similar. "Clean and minimal" is a good strategy when you're deploying assets to publicly accessible systems.

Reply on news.ycombinator.com