599 out of every 600 sites don't have the problem of a public facing .git folder. I don't think alternative deployments need to be suggested as they are commonplace.

It depends on what sort of platform and server you're running on but just do what you have to do so you're not serving your .git.