On: Git security vulnerability announced

[Too]

core.fsconfig is supposed to be read only, but since it’s an external process, git doesn’t know what really happens in there, so it can’t propagate any —-readonly enforcement.

[leni536 → Too]

That's where some sandboxing could help, maybe.