Almost 400k websites risk hacking, data theft via open .git repos, researcher warns