The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522545a6bfe
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = https://github.com/Elfsquad/ems fetch = +refs/heads/*:refs/remotes/origin/* [gc] auto = 0 [http "https://github.com/"] extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hwXzlVaGJFOUI0cExLVXNLOFJIaGdZRDZGaGtnRzJkTzBWQ092TQ== [branch "updating-angular-material"] remote = origin merge = refs/heads/updating-angular-material [submodule "setup-wizard"] active = true url = git@github.com:Elfsquad/setup-wizard.git [submodule "shared"] active = true url = git@github.com:Elfsquad/shared-angular-components.git
The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: medium
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522545a6bfe
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true [remote "origin"] url = https://github.com/Elfsquad/ems fetch = +refs/heads/*:refs/remotes/origin/* [gc] auto = 0 [http "https://github.com/"] extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hwXzlVaGJFOUI0cExLVXNLOFJIaGdZRDZGaGtnRzJkTzBWQ092TQ== [branch "updating-angular-material"] remote = origin merge = refs/heads/updating-angular-material [submodule "setup-wizard"] active = true url = git@github.com:Elfsquad/setup-wizard.git [submodule "shared"] active = true url = git@github.com:Elfsquad/shared-angular-components.git
Open service 20.50.153.39:443 · staging.ems.elfsquad.io
2026-01-12 18:41
HTTP/1.1 200 OK
Content-Length: 67115
Connection: close
Content-Type: text/html
Date: Mon, 12 Jan 2026 18:42:49 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "03733107"
Last-Modified: Mon, 12 Jan 2026 16:10:59 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Content-Security-Policy: iframe-ancestors 'none'
Page title: Elfsquad CPQ
<!doctype html>
<html lang="en" translate="no" data-beasties-container>
<head>
<meta charset="utf-8">
<title>Elfsquad CPQ</title>
<base href="/">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex">
<link rel="icon" type="image/x-icon" href="favicon.ico">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com">
<link rel="stylesheet" href="assets/styles/onboarding.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="assets/styles/onboarding.css"></noscript>
<link href="https://cdn.jsdelivr.net/npm/remixicon@4.3.0/fonts/remixicon.css" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,400;0,500;0,700;1,400&family=Barlow:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap" rel="stylesheet">
<script> //React Scan for localhost
if (window.location.href.indexOf('localhost') > -1) {
const script = document.createElement('script');
script.src = 'https://cdn.jsdelivr.net/npm/react-scan/dist/auto.global.js';
script.async = true;
const head = document.getElementsByTagName('head')[0];
const firstScript = head.getElementsByTagName('script')[0];
head.insertBefore(script, firstScript);
}
</script>
<script src="assets/eventsource-polyfill.js" type="text/javascript"></script>
<script> const global = globalThis;</script>
<script src="assets/postmessage.js" type="text/javascript"></script>
<link rel="stylesheet" href="https://cdn.zapier.com/packages/partner-sdk/v0/zapier-elements/zapier-elements.css">
<script>
MonacoEnvironment = {
getWorkerUrl: function (moduleId, label) {
if (label === 'json') {
return 'assets/monaco-editor/json.worker.bundle.js';
}
if (label === 'css' || label === 'scss' || label === 'less') {
return 'assets/monaco-editor/css.worker.bundle.js';
}
if (label === 'html' || label === 'handlebars' || label === 'razor') {
return 'assets/monaco-editor/html.worker.bundle.js';
}
if (label === 'typescript' || label === 'javascript') {
return 'assets/monaco-editor/ts.worker.bundle.js';
}
return 'assets/monaco-editor/editor.worker.bundle.js';
}
};
</script>
<!-- TODO: jspm -->
<script type="importmap">
{
"imports": {
"react": "https://cdn.jsdelivr.net/npm/react@18.3.1/+esm",
"react-dom": "https://cdn.jsdelivr.net/npm/react-dom@18.3.1/+esm",
"@fluentui/react": "https://cdn.jsdelivr.net/npm/@fluentui/react@8.119.3/+esm",
"@fluentui/react-charting": "https://cdn.jsdelivr.net/npm/@fluentui/react-charting@5.21.26/+esm",
"@fluentui/react-components": "https://cdn.jsdelivr.net/npm/@fluentui/react-components@9.54.6/+esm",
"@fluentui/react-icons": "https://cdn.jsdelivr.net/npm/@fluentui/react-icons@2.0.252/+esm",
"@tanstack/react-query": "https://cdn.jsdelivr.net/npm/@tanstack/react-query@5.51.15/+esm",
"react-reconciler": "https://cdn.jsdelivr.net/npm/react-reconciler@0.29.2/+esm"
},
"compilerOptions": {
"jsx": "react-jsx",
"jsxImportSource": "@fluentui/react-jsx-runtime"
}
}
</script>
<script type="module" src="https://cdn.zapier.com/packages/partner-sdk/v0/zapier-elements/zapier-elements.esm.js"></script>
<script src="https://cdn.jsdelivr.net/npm/apexcharts"></script>
<script type="module" defer>
import React from 'react';
React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactDebugCurrentFrame = {
getCurrentStack: () => '',
getStackAddendum: () => '',
setExtraStackFrame: () => '',
};
Open service 20.50.153.39:80 · staging.ems.elfsquad.io
2026-01-12 18:41
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 18:42:49 GMT Location: https://staging.ems.elfsquad.io/
Open service 51.124.12.35:443 · ems.elfsquad.io
2026-01-12 05:54
HTTP/1.1 200 OK
Content-Length: 67115
Connection: close
Content-Type: text/html
Date: Mon, 12 Jan 2026 05:55:03 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "13694918"
Last-Modified: Wed, 07 Jan 2026 14:55:43 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Content-Security-Policy: iframe-ancestors 'none'
Page title: Elfsquad CPQ
<!doctype html>
<html lang="en" translate="no" data-beasties-container>
<head>
<meta charset="utf-8">
<title>Elfsquad CPQ</title>
<base href="/">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="robots" content="noindex">
<link rel="icon" type="image/x-icon" href="favicon.ico">
<link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com">
<link rel="stylesheet" href="assets/styles/onboarding.css" media="print" onload="this.media='all'"><noscript><link rel="stylesheet" href="assets/styles/onboarding.css"></noscript>
<link href="https://cdn.jsdelivr.net/npm/remixicon@4.3.0/fonts/remixicon.css" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,400;0,500;0,700;1,400&family=Barlow:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
<link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap" rel="stylesheet">
<script> //React Scan for localhost
if (window.location.href.indexOf('localhost') > -1) {
const script = document.createElement('script');
script.src = 'https://cdn.jsdelivr.net/npm/react-scan/dist/auto.global.js';
script.async = true;
const head = document.getElementsByTagName('head')[0];
const firstScript = head.getElementsByTagName('script')[0];
head.insertBefore(script, firstScript);
}
</script>
<script src="assets/eventsource-polyfill.js" type="text/javascript"></script>
<script> const global = globalThis;</script>
<script src="assets/postmessage.js" type="text/javascript"></script>
<link rel="stylesheet" href="https://cdn.zapier.com/packages/partner-sdk/v0/zapier-elements/zapier-elements.css">
<script>
MonacoEnvironment = {
getWorkerUrl: function (moduleId, label) {
if (label === 'json') {
return 'assets/monaco-editor/json.worker.bundle.js';
}
if (label === 'css' || label === 'scss' || label === 'less') {
return 'assets/monaco-editor/css.worker.bundle.js';
}
if (label === 'html' || label === 'handlebars' || label === 'razor') {
return 'assets/monaco-editor/html.worker.bundle.js';
}
if (label === 'typescript' || label === 'javascript') {
return 'assets/monaco-editor/ts.worker.bundle.js';
}
return 'assets/monaco-editor/editor.worker.bundle.js';
}
};
</script>
<!-- TODO: jspm -->
<script type="importmap">
{
"imports": {
"react": "https://cdn.jsdelivr.net/npm/react@18.3.1/+esm",
"react-dom": "https://cdn.jsdelivr.net/npm/react-dom@18.3.1/+esm",
"@fluentui/react": "https://cdn.jsdelivr.net/npm/@fluentui/react@8.119.3/+esm",
"@fluentui/react-charting": "https://cdn.jsdelivr.net/npm/@fluentui/react-charting@5.21.26/+esm",
"@fluentui/react-components": "https://cdn.jsdelivr.net/npm/@fluentui/react-components@9.54.6/+esm",
"@fluentui/react-icons": "https://cdn.jsdelivr.net/npm/@fluentui/react-icons@2.0.252/+esm",
"@tanstack/react-query": "https://cdn.jsdelivr.net/npm/@tanstack/react-query@5.51.15/+esm",
"react-reconciler": "https://cdn.jsdelivr.net/npm/react-reconciler@0.29.2/+esm"
},
"compilerOptions": {
"jsx": "react-jsx",
"jsxImportSource": "@fluentui/react-jsx-runtime"
}
}
</script>
<script type="module" src="https://cdn.zapier.com/packages/partner-sdk/v0/zapier-elements/zapier-elements.esm.js"></script>
<script src="https://cdn.jsdelivr.net/npm/apexcharts"></script>
<script type="module" defer>
import React from 'react';
React.__SECRET_INTERNALS_DO_NOT_USE_OR_YOU_WILL_BE_FIRED.ReactDebugCurrentFrame = {
getCurrentStack: () => '',
getStackAddendum: () => '',
setExtraStackFrame: () => '',
};
Open service 51.124.12.35:80 · ems.elfsquad.io
2026-01-12 05:54
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 05:55:03 GMT Location: https://ems.elfsquad.io/