Cloning a repo is in fact the only safe way to get a repo from an untrusted source. Specifically, the Git project considers it a vulnerability if cloning a repo pwns you; they do not consider it a vulnerability if installing a repo a different way pwns you.
True. Mitigating this problem:
core.hooksPathis not inherited from cloned repos.An extremely cautionary move would be to never copy repos, always preferring cloning them.
score 1 · canonical
Cloning a repo is in fact the only safe way to get a repo from an untrusted source. Specifically, the Git project considers it a vulnerability if cloning a repo pwns you; they do not consider it a vulnerability if installing a repo a different way pwns you.
score 1 · canonical
deleted by creator