Every Docker image tells a story, but most developers don't realise how much of that story is written in the .git directories they accidentally ship. After analyzing more than half a million image layers from Docker Hub, we found around 500,000 .git repositories embedded in public images: each one an unintended archive of source code, full commit history, author identities, and hard-coded secrets. Over 228,000 of those images reference private or deleted repositories that were never meant to be visible, now permanently accessible to anyone with a docker pull. This talk presents the methodology and findings of the first large-scale study of .git exposure in Docker Hub. We cover: how git commit metadata enables identity attribution at scale; how 497 self-hosted internal git hostnames, including those of a cloud infrastructure provider, a semiconductor manufacturer, and a GPU vendor, were revealed by images their own owners published; and how ephemeral CI tokens (GitHub Actions ghs_ and GitLab CI job tokens) embedded in git configs can be raced to confirm live access before they expire. We close with concrete mitigations any developer can apply today.