diff --git a/deployment/cloud/vite.cloud.config.mjs b/deployment/cloud/vite.cloud.config.mjs
index 34138a879..3a304120a 100644
--- a/deployment/cloud/vite.cloud.config.mjs
+++ b/deployment/cloud/vite.cloud.config.mjs
@@ -81,6 +81,9 @@ export default async (e) => {
       allowedHosts: true,
       ...(hmr ? { hmr } : {}),
       ...(PUBLIC ? { proxy: { '^/(cdn|api-prod|pb|admin)/': { target: 'http://127.0.0.1:5175', ws: true } } } : {}),
+      // Public: the checkout's git internals are not served either (the private history, .git/config). Vite's
+      // defaults are restated because setting deny replaces them.
+      ...(PUBLIC ? { fs: { strict: true, deny: ['.env', '.env.*', '*.{crt,pem}', '**/.git/**'] } } : {}),
     },
   })
 }