Automic Vault

brew package intelligence

git

Automic Vault tracks git because plain text git credentials matters when AI agents run command-line tools on macOS.

overview

What Automic Vault knows about git

Distributed revision control system

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text Git Credentials

`git` can store HTTPS credentials in plaintext credential-store files such as ~/.git-credentials. Automic Vault currently detects this exposure but does not yet provide a migration or package modification for Git credential stores.

Local README excerpt

Git Radioisotope Detector

This detector reports plaintext Git credential-store files. It does not currently migrate credentials or modify Git.

Detected hazards:

  • ~/.git-credentials
  • global credential.helper = store --file ... paths

Git helpers backed by Keychain or other secret stores are not reported.

Source: data/radioisotopes/git/README.md

Caveats

  • We detect the default ~/.git-credentials file.
  • We detect global credential.helper store files with explicit --file paths.
  • osxkeychain, cache, and other non-plaintext helpers are not reported.

approval gates

Human review metadata for risky commands

The local approval-gate seed includes 7 rules for git. Covered entrypoints: git. Severity labels: critical, high, medium.

Example gated actions

  • Distributed revision control system
  • Push commits, tags, or refs to a remote repository.
  • Force-push or delete remote refs.
  • Reset local worktree and index destructively.
  • Delete untracked files from the worktree.
  • Read, approve, reject, or fill credentials through Git credential helpers.
  • Change credential helper configuration.

install metadata

Resolver facts

Package keybrew:git
Last updated2026-04-21T02:44:54Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • approval-gate seed metadata
  • local isotope README
  • radioisotope security manifest