Topic Thread
4 published observations tracking this thread.
A secret is different from ordinary configuration because disclosure can grant access. The engineering goal is to keep secrets out of source control and minimize their blast radius.
A leaked key is an incident, not just a Git mistake. The first job is to stop further use, then determine what the credential could access.
GitSpawn is not a prompt-injection story: it is a Git and agent-plumbing problem in which background context collection can execute repository-supplied commands with developer privileges.
Git stores snapshots connected by history; branches are movable names pointing into that history. Once you see the graph, most Git commands become easier to reason about.
