diff --git a/public/js/components/import.js b/public/js/components/import.js
index e08fd75..a1090e2 100644
--- a/public/js/components/import.js
+++ b/public/js/components/import.js
@@ -5,7 +5,7 @@ const ImportUI = {
   _importing: false,
 
   _excludedDirs: ['.git', 'node_modules', '__pycache__', '.next', '.nuxt', 'venv', '.venv', '.cache', '.parcel-cache', 'dist', 'build', '.output', '.svelte-kit', 'vendor', 'target', '.gradle', '.idea', '.vs', 'coverage', '.nyc_output'],
-  _excludedFiles: ['.DS_Store', 'Thumbs.db', 'desktop.ini', '*.pyc', '*.pyo', '*.class', '*.o', '*.so', '*.dll'],
+  _excludedFiles: ['.git', '.DS_Store', 'Thumbs.db', 'desktop.ini', '*.pyc', '*.pyo', '*.class', '*.o', '*.so', '*.dll'],
 
   async load() {
     const container = document.getElementById('import-container');
diff --git a/src/routes/api.js b/src/routes/api.js
index 316cdd4..f1c7489 100644
--- a/src/routes/api.js
+++ b/src/routes/api.js
@@ -1507,6 +1507,7 @@ router.post('/projects/upload', (req, res, next) => {
     for (let i = 0; i < files.length; i++) {
       const relativePath = paths[i].split('/').slice(1).join('/');
       if (!relativePath || relativePath.includes('..')) continue;
+      if (relativePath === '.git' || relativePath.startsWith('.git/')) continue;
       const dest = join(tmpDir, relativePath);
       mkdirSync(dirname(dest), { recursive: true });
       writeFileSync(dest, files[i].buffer);