A scanner that reads a repository checkout sees text pointers for any file tracked by Git LFS, not the audio, texture or binary itself, unless the CI job fetched the LFS content. So a scan of a bare checkout can miss the very files you most want to inventory.
How Git LFS works
The Git LFS project describes it as replacing large files such as audio samples, videos, datasets and graphics with text pointers inside Git, while storing the file contents on a remote server. You choose file types to manage with a tracking command, for example for PSD files, and the choice lives in your .gitattributes file.
The project also notes that defining tracked types does not by itself convert files already in your history. Migration is a separate step.
Game studios use LFS heavily, because textures, audio banks, models and prebuilt libraries are big.
What goes wrong for scanning
Three situations come up.
- A CI job clones without fetching LFS objects. The workspace holds pointer files. A scan or SBOM step that looks for binaries finds only small text files.
- A shallow clone. Unity's own documentation says its Package Manager uses shallow clones for Git dependencies, so LFS tracked files are not always fetched correctly and a package may import placeholder pointer files instead of real content.
- Prebuilt native libraries stored in LFS. Those libraries are exactly what you want listed. A pointer file hides the library's contents and its version.
The result is a false sense of completeness: the scan ran, found nothing odd, and passed.
A checklist for your pipeline
- Find out which paths are tracked by LFS: read .gitattributes.
- List any native libraries, plugin binaries or middleware archives among them.
- In CI, fetch LFS objects before any scan or SBOM generation, or scan the built output instead of the source checkout.
- Add a check that fails if a file you expect to be large is under a small size threshold, which is a sign it is still a pointer.
- Keep the LFS client current. The Git LFS site carries a security notice telling all users to update to version 3.7.1 or newer, so confirm which version your build agents run.
- Record in your inventory where each prebuilt binary came from.
Where to scan
Manifests and lock files give declared dependencies, and they are small text files that are never hidden by LFS. Built outputs show what actually ships. A good pipeline uses both. The post on engines, middleware and asset packs covers building the list of what to expect.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which components are listed and ask which of them in your own repo would sit behind a pointer file.
Quick check
Does Git LFS remove the files from my repository history?
Per the Git LFS project, it replaces large files with text pointers inside Git and stores the contents on a remote server. Existing history needs a separate migrate step.
Can Unity import a pointer file by mistake?
Unity's documentation says that, because it uses shallow clones for Git dependencies, a package might import placeholder pointer files instead of the actual file contents.
Sources
Last reviewed: 19 October 2026.
