Just keep the .git bare repo outside the document root.