Put this in a VirtualHost config block to make sure git files aren't served by the Apache process:
VirtualHost
<Directorymatch "^/.*/\.git/"> Deny from all </Directorymatch>
Won't work in an .htaccess file.
.htaccess