git
Safeguard articles tagged "git" — guides, analysis, and best practices for software supply chain and application security.
24 articles
Push Protection Stops the Next Secret, Not the 500 Already in Your History
Blocking a credential at git push is genuinely good and solves exactly one half of the problem. The other half is every commit you have ever made, and deleting those commits is not the fix either.
Your Git History Already Knows Which AI Wrote Your Code
Coding assistants sign their own work in the commit trailer block. That makes 'how much of this was AI-written' a parsing problem, not a heuristic one — as long as your tooling reads the commit body, which most of it does not.
Git Argument Injection via Crafted SSH URL (CVE-2017-1000...
CVE-2017-1000117 let a malicious repo run code on anyone who cloned it via a crafted ssh:// URL. Impact, affected Git versions, CVSS, and fixes.
Git Remote Code Execution via Malicious .gitmodules Submo...
CVE-2018-11235 let a malicious .gitmodules file hijack Git submodule checkout, executing arbitrary code via post-checkout hooks on clone.
Detecting Hardcoded Secrets in Code (2026 Guide)
Nearly 24 million secrets leaked to public GitHub in 2024 alone. This guide covers how hardcoded secrets get in, how detection actually works, and how to catch them pre-commit with real commands.
How to Scan for Secrets in a Git Repository
Find hardcoded API keys, tokens, and credentials in your working tree and full Git history, stop new leaks at commit time, and remediate a secret that has already been pushed.
How to Git Pull a Remote Branch (and Check It Out Safely)
A clear guide to git pull remote branch workflows: fetching, checking out a remote branch for the first time, and the tracking setup that avoids surprises.
gittuf Reaches OpenSSF Incubating: A Forge-Independent Git Security Layer
gittuf was promoted from OpenSSF Sandbox to Incubating in June 2025. We unpack the Reference State Log, policy model, and why it matters for SLSA Source L3.
GitGuardian vs TruffleHog: choosing a secrets detection tool in 2026
How GitGuardian and TruffleHog compare on detection accuracy, false positive handling, remediation workflow, and enterprise rollout for secrets scanning programs.
Git Repository URL: How to Find, Copy, and Change It Safely
A Git repository URL is the address Git uses to fetch and push code. Here is how to get your repository URL from the command line and GitHub, plus the security details that matter.
How to Git Fetch a Branch (and Why It Matters for Security)
How to git fetch a specific branch, the difference between fetch and pull, and why fetch-then-review is the safer default for teams handling untrusted code.
Applying Git Patches Safely
Knowing how to apply a patch in git without breaking your working tree takes more than running git apply once and hoping for the best.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.