rules-git

Amending commits rewrites history. If this commit has been pushed to a shared branch, amending requires a force push which affects others.

Force branch deletion detected. This removes the branch even if it hasn't been merged. Verify the branch is no longer needed.

Destructive checkout detected. This discards uncommitted changes permanently. Stash your work first if you want to recover it.

Rebase rewrites commit history. On shared branches this causes problems for anyone who has pulled. Confirm this is on a local or personal branch.

Recursive submodule clone detected. RISK: CVE-2024-32002 and CVE-2025-48384 allow crafted submodules to write into .git/ and trigger post-checkout RCE on Git <2.50.1. FIX: clone without --recurse-submodules, inspect .gitmodules, then run 'git submodule update --init' on a trusted Git version.

Submodule update detected. RISK: CVE-2025-48384 — a carriage-return in a submodule path checks out files outside the worktree and can install a hook that executes on the next git command. FIX: verify .gitmodules has no control characters and ensure git >= 2.50.1.

Direct ref deletion via update-ref detected. RISK: bypasses branch/tag safety checks and leaves no reflog entry for recovery. FIX: use 'git branch -d' or 'git tag -d' so the operation is logged and the default gc window can recover it.

credential.helper=store is blocked. RISK: it writes plaintext credentials to ~/.git-credentials, readable by any process on the host. FIX: use an OS keychain helper (osxkeychain, manager-core, libsecret) or the short-lived 'cache' helper.

git filter-branch is blocked. RISK: officially deprecated — has known safety and performance bugs that silently corrupt history. FIX: use 'git filter-repo' (https://github.com/newren/git-filter-repo), which is the project-recommended replacement.

Global/system url.*.insteadOf rewrites are blocked. RISK: silently redirects every future clone/fetch through an attacker host (supply-chain MITM). FIX: scope URL rewrites to a single repo with 'git config --local' after human review.

Immediate reflog expiry / gc prune is blocked. RISK: permanently deletes unreachable objects so mistakes from reset/rebase/branch-delete become unrecoverable. FIX: rely on the default 90-day reflog window, or prune with '--prune=1.day.ago' after a manual backup.

Writing into .git/hooks is blocked. RISK: any executable placed there runs automatically on the matching git event (commit, checkout, merge) — a direct RCE foothold. FIX: use Husky, lefthook, or pre-commit which version-control hooks inside the repo under review.

Merge commit recorded. Consider 'git merge --no-ff' for a clear merge history, or use rebase on feature branches for a linear history.

Committing secret files is blocked. Environment files and credentials must never enter version control. Add them to .gitignore immediately.

node_modules must not be committed. Add 'node_modules/' to .gitignore and use package.json + lockfiles to reproduce the install.

Temporary or debug file detected in git add. Remove it from staging — these files should be in .gitignore.

Force push is blocked. It rewrites shared history and can permanently destroy teammates' work. Use 'git revert' to undo changes safely.

Setting core.fsmonitor to an arbitrary command is blocked. RISK: git executes this command on every invocation — an attacker-controlled value yields silent RCE. FIX: use the built-in 'true' fsmonitor daemon or leave the setting unset.

Force-clean is blocked. It permanently deletes untracked files with no recovery path. Review untracked files with 'git status' first.

Hard reset is blocked. It permanently discards uncommitted changes and commits. Use 'git stash' to save work, or 'git revert' to undo commits safely.

Overriding core.hooksPath is blocked. RISK: redirecting hooks lets any future git operation execute attacker-controlled scripts (persistent RCE). FIX: keep hooks in the repo's default .git/hooks directory and review each hook before enabling.