Open Git directories leave 390K websites vulnerable