The following URL (usually /.git/config) is publicly accessible and is leaking source code and repository configuration.
Severity: high
Fingerprint: 2580fa947178c88602b1737db148c044b81b03713d63bb82370a6522fba46e73
[core] repositoryformatversion = 0 filemode = true bare = false logallrefupdates = true longpaths = true [remote "origin"] url = https://hexadsolutions@dev.azure.com/hexadsolutions/NaaS/_git/NaaS-Vanilla fetch = +refs/heads/*:refs/remotes/origin/* [extensions] worktreeConfig = true [gc] auto = 0 [http] version = HTTP/1.1
Open service 51.124.12.35:443 · naas.err.services
2026-01-09 03:04
HTTP/1.1 200 OK
Content-Length: 2698
Connection: close
Content-Type: text/html
Date: Fri, 09 Jan 2026 03:05:09 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "57212965"
Last-Modified: Mon, 11 Aug 2025 19:38:11 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Page title: naas.err.services
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>naas.err.services</title>
<link rel="stylesheet" href="styles.css">
<meta name="description" content="naas-err-services">
</head>
<body>
<div class="container">
<header>
<h1>naas.err.services</h1>
</header>
<main>
<div class="reason-container">
<div class="computer-icon">🖥️</div>
<div class="reason-text" id="reason-text">
Loading reason...
</div>
<button class="refresh-btn" onclick="loadNewReason()">Get Another Reason</button>
</div>
</main>
<nav>
<a href="about.html" class="nav-link">About</a>
</nav>
<footer>
<p>I'd like to '© 2025', but to be honest, the logic\code is 100% generated from LLM's and all I'm doing is using it to learn. </p>
</footer>
</div>
<script src="script.js"></script>
<script>
// Enhanced curl detection with better user agent checking
function isCurlRequest() {
const ua = navigator.userAgent.toLowerCase();
return ua.includes('curl') ||
ua.includes('wget') ||
ua.includes('httpie') ||
ua.includes('postman') ||
ua === '' || // Some curl requests have empty user agent
window.location.search.includes('format=text') ||
window.location.search.includes('api=true');
}
// If curl-like request detected, return plain text
if (isCurlRequest()) {
fetch('reasons.json')
.then(response => response.json())
.then(reasons => {
if (reasons && reasons.length > 0) {
const randomReason = reasons[Math.floor(Math.random() * reasons.length)];
// Replace entire page with just the reason
document.open();
document.write(randomReason);
document.close();
// Set proper content type
document.contentType = 'text/plain';
}
})
.catch(() => {
document.open();
document.write('The system is temporarily unavailable due to unforeseen circumstances.');
document.close();
});
}
</script>
</body>
</html>
Open service 51.124.12.35:443 · naas.err.services
2026-01-01 23:38
HTTP/1.1 200 OK
Content-Length: 2698
Connection: close
Content-Type: text/html
Date: Thu, 01 Jan 2026 23:38:44 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "57212965"
Last-Modified: Mon, 11 Aug 2025 19:38:11 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Page title: naas.err.services
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>naas.err.services</title>
<link rel="stylesheet" href="styles.css">
<meta name="description" content="naas-err-services">
</head>
<body>
<div class="container">
<header>
<h1>naas.err.services</h1>
</header>
<main>
<div class="reason-container">
<div class="computer-icon">🖥️</div>
<div class="reason-text" id="reason-text">
Loading reason...
</div>
<button class="refresh-btn" onclick="loadNewReason()">Get Another Reason</button>
</div>
</main>
<nav>
<a href="about.html" class="nav-link">About</a>
</nav>
<footer>
<p>I'd like to '© 2025', but to be honest, the logic\code is 100% generated from LLM's and all I'm doing is using it to learn. </p>
</footer>
</div>
<script src="script.js"></script>
<script>
// Enhanced curl detection with better user agent checking
function isCurlRequest() {
const ua = navigator.userAgent.toLowerCase();
return ua.includes('curl') ||
ua.includes('wget') ||
ua.includes('httpie') ||
ua.includes('postman') ||
ua === '' || // Some curl requests have empty user agent
window.location.search.includes('format=text') ||
window.location.search.includes('api=true');
}
// If curl-like request detected, return plain text
if (isCurlRequest()) {
fetch('reasons.json')
.then(response => response.json())
.then(reasons => {
if (reasons && reasons.length > 0) {
const randomReason = reasons[Math.floor(Math.random() * reasons.length)];
// Replace entire page with just the reason
document.open();
document.write(randomReason);
document.close();
// Set proper content type
document.contentType = 'text/plain';
}
})
.catch(() => {
document.open();
document.write('The system is temporarily unavailable due to unforeseen circumstances.');
document.close();
});
}
</script>
</body>
</html>
Open service 51.124.12.35:443 · naas.err.services
2025-12-30 10:43
HTTP/1.1 200 OK
Content-Length: 2698
Connection: close
Content-Type: text/html
Date: Tue, 30 Dec 2025 10:43:24 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "57212965"
Last-Modified: Mon, 11 Aug 2025 19:38:11 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Page title: naas.err.services
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>naas.err.services</title>
<link rel="stylesheet" href="styles.css">
<meta name="description" content="naas-err-services">
</head>
<body>
<div class="container">
<header>
<h1>naas.err.services</h1>
</header>
<main>
<div class="reason-container">
<div class="computer-icon">🖥️</div>
<div class="reason-text" id="reason-text">
Loading reason...
</div>
<button class="refresh-btn" onclick="loadNewReason()">Get Another Reason</button>
</div>
</main>
<nav>
<a href="about.html" class="nav-link">About</a>
</nav>
<footer>
<p>I'd like to '© 2025', but to be honest, the logic\code is 100% generated from LLM's and all I'm doing is using it to learn. </p>
</footer>
</div>
<script src="script.js"></script>
<script>
// Enhanced curl detection with better user agent checking
function isCurlRequest() {
const ua = navigator.userAgent.toLowerCase();
return ua.includes('curl') ||
ua.includes('wget') ||
ua.includes('httpie') ||
ua.includes('postman') ||
ua === '' || // Some curl requests have empty user agent
window.location.search.includes('format=text') ||
window.location.search.includes('api=true');
}
// If curl-like request detected, return plain text
if (isCurlRequest()) {
fetch('reasons.json')
.then(response => response.json())
.then(reasons => {
if (reasons && reasons.length > 0) {
const randomReason = reasons[Math.floor(Math.random() * reasons.length)];
// Replace entire page with just the reason
document.open();
document.write(randomReason);
document.close();
// Set proper content type
document.contentType = 'text/plain';
}
})
.catch(() => {
document.open();
document.write('The system is temporarily unavailable due to unforeseen circumstances.');
document.close();
});
}
</script>
</body>
</html>
Open service 51.124.12.35:443 · naas.err.services
2025-12-23 01:04
HTTP/1.1 200 OK
Content-Length: 2698
Connection: close
Content-Type: text/html
Date: Tue, 23 Dec 2025 01:04:16 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "57212965"
Last-Modified: Mon, 11 Aug 2025 19:38:11 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Page title: naas.err.services
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>naas.err.services</title>
<link rel="stylesheet" href="styles.css">
<meta name="description" content="naas-err-services">
</head>
<body>
<div class="container">
<header>
<h1>naas.err.services</h1>
</header>
<main>
<div class="reason-container">
<div class="computer-icon">🖥️</div>
<div class="reason-text" id="reason-text">
Loading reason...
</div>
<button class="refresh-btn" onclick="loadNewReason()">Get Another Reason</button>
</div>
</main>
<nav>
<a href="about.html" class="nav-link">About</a>
</nav>
<footer>
<p>I'd like to '© 2025', but to be honest, the logic\code is 100% generated from LLM's and all I'm doing is using it to learn. </p>
</footer>
</div>
<script src="script.js"></script>
<script>
// Enhanced curl detection with better user agent checking
function isCurlRequest() {
const ua = navigator.userAgent.toLowerCase();
return ua.includes('curl') ||
ua.includes('wget') ||
ua.includes('httpie') ||
ua.includes('postman') ||
ua === '' || // Some curl requests have empty user agent
window.location.search.includes('format=text') ||
window.location.search.includes('api=true');
}
// If curl-like request detected, return plain text
if (isCurlRequest()) {
fetch('reasons.json')
.then(response => response.json())
.then(reasons => {
if (reasons && reasons.length > 0) {
const randomReason = reasons[Math.floor(Math.random() * reasons.length)];
// Replace entire page with just the reason
document.open();
document.write(randomReason);
document.close();
// Set proper content type
document.contentType = 'text/plain';
}
})
.catch(() => {
document.open();
document.write('The system is temporarily unavailable due to unforeseen circumstances.');
document.close();
});
}
</script>
</body>
</html>
Open service 51.124.12.35:443 · naas.err.services
2025-12-20 22:42
HTTP/1.1 200 OK
Content-Length: 2698
Connection: close
Content-Type: text/html
Date: Sat, 20 Dec 2025 22:42:13 GMT
Cache-Control: public, must-revalidate, max-age=30
ETag: "57212965"
Last-Modified: Mon, 11 Aug 2025 19:38:11 GMT
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Referrer-Policy: same-origin
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-DNS-Prefetch-Control: off
Page title: naas.err.services
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>naas.err.services</title>
<link rel="stylesheet" href="styles.css">
<meta name="description" content="naas-err-services">
</head>
<body>
<div class="container">
<header>
<h1>naas.err.services</h1>
</header>
<main>
<div class="reason-container">
<div class="computer-icon">🖥️</div>
<div class="reason-text" id="reason-text">
Loading reason...
</div>
<button class="refresh-btn" onclick="loadNewReason()">Get Another Reason</button>
</div>
</main>
<nav>
<a href="about.html" class="nav-link">About</a>
</nav>
<footer>
<p>I'd like to '© 2025', but to be honest, the logic\code is 100% generated from LLM's and all I'm doing is using it to learn. </p>
</footer>
</div>
<script src="script.js"></script>
<script>
// Enhanced curl detection with better user agent checking
function isCurlRequest() {
const ua = navigator.userAgent.toLowerCase();
return ua.includes('curl') ||
ua.includes('wget') ||
ua.includes('httpie') ||
ua.includes('postman') ||
ua === '' || // Some curl requests have empty user agent
window.location.search.includes('format=text') ||
window.location.search.includes('api=true');
}
// If curl-like request detected, return plain text
if (isCurlRequest()) {
fetch('reasons.json')
.then(response => response.json())
.then(reasons => {
if (reasons && reasons.length > 0) {
const randomReason = reasons[Math.floor(Math.random() * reasons.length)];
// Replace entire page with just the reason
document.open();
document.write(randomReason);
document.close();
// Set proper content type
document.contentType = 'text/plain';
}
})
.catch(() => {
document.open();
document.write('The system is temporarily unavailable due to unforeseen circumstances.');
document.close();
});
}
</script>
</body>
</html>