I agree with never deploying a .git folder to prod.

Part of our deployment script for sites has something like:

  git clone -d 1 -b $BRANCH https://blahblah.tld/project
  rm -rf .git*

So no .git directory, .gitignore, and so on.