BOTTLENECKNo. 01

0 articles opened

Part I · Day One · Where you should be · p. 22–23

Day One checklist

Tick it off honestly — the gaps are where you will fail next week.

0 of 18 complete

Installed

securegit --version returns a version
~/.config/securegit/ exists
I know how to uninstall it (delete binary + that directory)

Acquisition

I have acquired at least one repository
I checked .git/hooks and confirmed it was empty
I read a .securegit-report.json
safe-clone is aliased and I have used it once instead of git clone

Scanning

I have scanned a repository I actually work in
I looked at every critical finding
I rotated anything real (or confirmed there was nothing real)
skip_paths is configured for my dependency directories
I have run scan-diff at least once and seen how fast it is

Muscle memory

sgit (or equivalent) is aliased
Tab completion works on the alias
SECUREGIT_FAIL_ON and SECUREGIT_SKIP_PATHS are set

Guardrail

A pre-commit hook is installed in at least one repository
I have seen it pass
I know how to override it (--no-verify) and why I should not do so reflexively

You can stop here.

Part I is a complete, coherent adoption. Acquisition plus scanning plus a pre-commit hook is a real improvement in your security posture and it costs you almost nothing ongoing. A reader who stops at this page and keeps the habit has gotten more value than a reader who finishes the issue and installs nothing.

Yes, somewhat, in specific places The mental model