Skip to content

docs(security): clarify command wrapper responsibilities #2342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Byron merged 1 commit into from
Nov 10, 2026
+17 −0
Merged

docs(security): clarify command wrapper responsibilities #2342

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,23 @@ For an untrusted repository directory, Git recommends obtaining a clean copy wit
unprivileged user for additional isolation. See
[Git's `git-upload-pack` security guidance](https://github.com/git/git/blob/master/Documentation/git-upload-pack.adoc#security).

`git.cmd.Git`, also exposed as `repo.git`, is a low-level command wrapper: it
runs the Git command with the arguments and options the caller supplies. It does
what it is told, including file reads, writes, or command execution requested
through those options. These explicitly requested effects are intended command
behavior, not unwanted side effects. For example,
`repo.git.checkout(pathspec_from_file=path)` asks Git to read `path` as pathspec
input, and Git's diagnostics may include that input. Applications exposing this
interface to untrusted callers must restrict commands, arguments, and options
and control which output and errors they disclose.

Higher-level methods, such as `Head.checkout()` and `Repo.clone_from()`, provide
specific operations and apply protections against options or operands that
introduce unwanted side effects beyond those operations. Where supported,
callers can explicitly opt into unsafe behavior. These protections do not
restrict direct calls through the command wrapper; bypasses of higher-level
protections remain reportable.

Violations of these trust boundaries or bypasses of Git's intended protections
remain reportable, including cases where Git itself is affected.

Expand Down
Loading