$#source-code-disclosure

Hacker Holidays — Day 2: Room 404

A Flask app leaves .git/ reachable — git-dumper reconstructs the full repo, and a "remove before launch" note in the staging README hands over the flag directly.

• #hacker-holidays
• #web
• #source-code-disclosure