@@ -37,6 +37,23 @@ For an untrusted repository directory, Git recommends obtaining a clean copy wit
 unprivileged user for additional isolation. See
 [Git's `git-upload-pack` security guidance](https://github.com/git/git/blob/master/Documentation/git-upload-pack.adoc#security).
 
+`git.cmd.Git`, also exposed as `repo.git`, is a low-level command wrapper: it
+runs the Git command with the arguments and options the caller supplies. It does
+what it is told, including file reads, writes, or command execution requested
+through those options. These explicitly requested effects are intended command
+behavior, not unwanted side effects. For example,
+`repo.git.checkout(pathspec_from_file=path)` asks Git to read `path` as pathspec
+input, and Git's diagnostics may include that input. Applications exposing this
+interface to untrusted callers must restrict commands, arguments, and options
+and control which output and errors they disclose.
+
+Higher-level methods, such as `Head.checkout()` and `Repo.clone_from()`, provide
+specific operations and apply protections against options or operands that
+introduce unwanted side effects beyond those operations. Where supported,
+callers can explicitly opt into unsafe behavior. These protections do not
+restrict direct calls through the command wrapper; bypasses of higher-level
+protections remain reportable.
+
 Violations of these trust boundaries or bypasses of Git's intended protections
 remain reportable, including cases where Git itself is affected.