Comment by supriyo-biswas

This approach is fine for static websites, but for web applications you should probably block requests to /.git so that people can’t clone your application off of the web.