ShortGit does not own authentication. Real Git, SSH, Git Credential Manager, or GitHub CLI remain responsible for credentials and transport.

ShortGit must never persist passwords, personal access tokens, OAuth tokens, private keys, or credential-helper output. Configuration files contain only repository defaults and trust policy.

Tracked hooks are executable code. Automatic hook activation is limited to the configured Git host and either the default owner or an explicitly trusted owner. --hooks is an explicit trust decision for one clone. Unknown repositories default to hooks disabled.

ShortGit never executes arbitrary repository-provided bootstrap commands. In v0.1, post-clone bootstrap is inspection-only.

Please report vulnerabilities privately through GitHub's security advisory feature rather than a public issue.