On one of my web applications, I accidentally left the .git directory readable by the web server for the last few weeks. Index listing was disabled. Visiting the website.com/.git URL would result in a 404 error that was indistinguishable from any other 404 error, but browsing to website.com/.git/config for example would download the file.
What kind of risks are there with my applications? Is it possible that enough information is exposed that someone could have downloaded the entire application's source code?