Part I · Day One · Muscle memory · p. 16–17

Alias it before you do anything else

The single biggest predictor of whether you are still using this in a month is whether typing it costs you anything.

The command is called securegit because the name should be unambiguous when someone reads it in a script, a runbook, or a CI file six months from now. It is not meant to be typed nine characters at a time, forty times a day. Optimize the written name for the reader; optimize the typed name for the typist.

~/.securegit_aliases

alias sgit='securegit'
alias sg='securegit'
alias safe-clone='securegit acquire'
alias scan-here='securegit scan .'
alias scan-deep='securegit scan . --include-git'
alias scan-staged='securegit scan --staged --fail-on high'
alias scan-diff='git diff main --name-only | xargs securegit scan'
alias scan-clean='securegit scan . --skip-paths "**/node_modules/**,**/vendor/**"'

scan-diff is the one you will use most and it is the one people discover last. Scanning only what changed against your main branch turns a multi-second operation into a sub-second one.

Set once, stop passing flags

export SECUREGIT_FAIL_ON=high
export SECUREGIT_SKIP_PATHS='**/node_modules/**:**/vendor/**:**/target/**:**/dist/**'

What drop-in actually means

ShippedThree layers: native ops, eighteen thin wrappers, External passthrough.

Native porcelain — status, add, commit, push, pull, fetch, merge, checkout, branch, rebase — is implemented in SecureGit itself, as are acquire, scan, undo, hf, workflow, secret, sbom, and the chain commands. Those never fall through to system git. Eighteen thin wrappers (bisect, reflog, submodule, sparse-checkout, grep, describe, format-patch…) forward to system git. Unrecognized subcommands go to system git under SECUREGIT_FALLBACK_POLICY: strict refuses, unverified-op (default) runs with a Tier-B receipt, passthrough runs with no receipt.