git
Safeguard articles tagged "git" — guides, analysis, and best practices for software supply chain and application security.
25 articles
Deleting the Line Does Not Delete the Secret From Git History
A scanner flags a credential from fourteen months ago, removed in the very next commit. The current file is clean, which feels like the problem is solved. The blob holding that value is still reachable from the earlier commit.
Git Ancestry Lies About Whether Work Shipped
A commit hash derives from its parents, so a rewrite gives identical changes new identities. is-ancestor answers graph position, not whether the change is present, and squash merges put most teams in this state permanently.
CVE-2025-48384: Git Link Following Vulnerability
CVE-2025-48384 affects Git Git and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2025-08-25.
Push Protection Stops the Next Secret, Not the 500 Already in Your History
Blocking a credential at git push is genuinely good and solves exactly one half of the problem. The other half is every commit you have ever made, and deleting those commits is not the fix either.
Your Git History Already Knows Which AI Wrote Your Code
Coding assistants sign their own work in the commit trailer block. That makes 'how much of this was AI-written' a parsing problem, not a heuristic one — as long as your tooling reads the commit body, which most of it does not.
Git Argument Injection via Crafted SSH URL (CVE-2017-1000...
CVE-2017-1000117 let a malicious repo run code on anyone who cloned it via a crafted ssh:// URL. Impact, affected Git versions, CVSS, and fixes.
Git Remote Code Execution via Malicious .gitmodules Submo...
CVE-2018-11235 let a malicious .gitmodules file hijack Git submodule checkout, executing arbitrary code via post-checkout hooks on clone.
Detecting Hardcoded Secrets in Code (2026 Guide)
Nearly 24 million secrets leaked to public GitHub in 2024 alone. This guide covers how hardcoded secrets get in, how detection actually works, and how to catch them pre-commit with real commands.
How to Git Pull a Remote Branch (and Check It Out Safely)
A clear guide to git pull remote branch workflows: fetching, checking out a remote branch for the first time, and the tracking setup that avoids surprises.
gittuf Reaches OpenSSF Incubating: A Forge-Independent Git Security Layer
gittuf was promoted from OpenSSF Sandbox to Incubating in June 2025. We unpack the Reference State Log, policy model, and why it matters for SLSA Source L3.
GitGuardian vs TruffleHog: choosing a secrets detection tool in 2026
How GitGuardian and TruffleHog compare on detection accuracy, false positive handling, remediation workflow, and enterprise rollout for secrets scanning programs.
Git Repository URL: How to Find, Copy, and Change It Safely
A Git repository URL is the address Git uses to fetch and push code. Here is how to get your repository URL from the command line and GitHub, plus the security details that matter.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.