transfer.fsckObjects makes git check objects it receives on fetch or push and abort on malformed ones. protocol.allow sets which transports git may use, and by default only http, https, git and ssh are always allowed while others, including file, are user restricted. Both are cheap hardening for machines that clone code.
transfer.fsckObjects
The git documentation says it defaults to false. When set, a fetch or receive aborts on a malformed object or a link to a nonexistent object. It also checks for issues, including legacy ones and potential security issues such as the existence of a .GIT directory or a malicious .gitmodules file. Those checks relate to attacks where a crafted repository abuses how git handles paths and submodules.
Set it with:
git config --global transfer.fsckObjects true
The cost is some extra work per fetch. For ordinary projects it is hardly noticeable, and very large repositories are where you would measure it.
protocol.allow
protocol.allow sets the default policy for transports that do not have their own policy. Per transport policies use protocol.<name>.allow. The documented defaults:
| Transport | Default policy |
|---|---|
| http, https, git, ssh | always |
| ext | never |
| file and others | user |
The values are always, never and user. The user policy means the transport is allowed only when the user, not a script running git on their behalf, started the command. It exists so that a submodule URL in a cloned repository cannot quietly reach into local paths or exotic transports.
A cautious setup lists what you actually use and denies the rest:
git config --global protocol.allow never
git config --global protocol.https.allow always
git config --global protocol.ssh.allow always
Do this only if you know your tools do not need file or git transports. Some workflows, such as local mirrors in CI, do.
Related protections
Git also refuses to parse the config of a repository owned by another user unless the directory is listed in safe.directory, a setting it only respects from protected configuration so that an untrusted repository cannot add itself. See should your CLI refuse repos owned by someone else. For hooks, see share git hooks with core.hooksPath.
Steps
- Run
git config --global --listand see what you already set. - Enable transfer.fsckObjects globally.
- Decide whether to restrict protocols; test with a normal clone and a submodule clone.
- Keep the settings in a dotfiles repository so new machines get them.
- Update git itself. Settings help, but fixes for path handling bugs ship in new releases.
Safeguard's dependency scanning covers git based dependencies in package manifests as well as registry packages. A free scan is at gold.safeguard.sh/scan.
Quick check
Will transfer.fsckObjects slow my clones?
It adds checks on received objects, so there is some cost. Most teams will not notice it, and you can measure on your largest repository.
Can protocol.allow break my submodules?
Yes, if they use a transport you denied. Test a submodule clone after changing it.
Sources
Last reviewed: 19 October 2026.
