No. 01 · The Untrusted Clone · A limited series
Git clone runs somebody else's code.
You knew that. You did it anyway, this week, probably twice. A field guide to SecureGit — and to git that can prove what happened.
ArmyknifeLabs · v0.12.24 · 81 pages
Ten minutes
The quickstart. It ends with you having scanned a real repository. Everything else is optional after that.
An evening
Part I in full — install, first acquire, first scan, aliases, the pre-commit hook, and a straight answer on speed.
Evaluating for a team
Start at the twelve objections, then the 30-day rollout, then come back to Part II. Your team will raise the objections before you finish your first sentence.
Regulated environment
Parts III and IV: SBOM anchoring, CVE state over time, license posture, the credential boundary, agents/MCP, HuggingFace. Then the maturity table, because some of what you need is designed and not yet shipped.
BOTTLENECK
No. 01 · The Untrusted Clone · A limited series
Git clone runs somebody else's code.
You knew that. You did it anyway, this week, probably twice. A field guide to SecureGit — and to git that can prove what happened.
- Day Oneinstalled and scanning in ten minutes
- Acquire, not clonewhy archive-first defeats hooks
- Twelve scannersthe built-in set, and the plugin ladder
- The guarded commita gate that does not slow you down
- Receiptscryptographic chain of custody for every push
- SARIF + GitLab SASTreports that upload where your dashboards already live
- Baselinesadopting on legacy code without failing every build
- Audit loghash-chained, tamper-evident, SIEM-ready
- Handles, not valuesgiving agents credentials they never see
- HuggingFace pathacquire a model the way you acquire a repo
- The 30-day rolloutsolo, then team, then org
- Twelve objectionsanswered honestly, including the ones we lose