Comment by datalopers

They've got something a bit more fucked up than just an exposed .gitignore

    $ curl -si https://www.tesla.com/ | grep generator
    x-generator: Drupal 9 (https://www.drupal.org)

    $ curl -si https://www.tesla.com/authorize.php | grep generator
    x-generator: Drupal 7 (http://drupal.org)

So they have at least two versions running at the same time. The /authorize.php [1] uri also yields a 500 (instead of a 403 like most of the other resources), which implies Apache is most likely passing the request off to PHP and the script has a fatal or unhandled error.

The webroot appears to be a Drupal 7.x installation and Apache is serving that content directly (e.g. https://www.tesla.com/MAINTAINERS.txt same as [2]) and trying to run some of it (authorize.php), while happy-path requests are being reverse-proxied to a Drupal 9.x installation.

[1] https://github.com/drupal/drupal/blob/7.x/authorize.php

[2] https://github.com/drupal/drupal/blob/7.x/MAINTAINERS.txt