After publication, use GitHub private vulnerability reporting for bunta-expert/git-path-audit. Do not disclose exploitable path payloads in a public issue. Include the affected version and commit, invocation/source mode, raw bytes encoded as hex or base64, observed output, and whether a terminal, CI parser, or Git command was affected.

The CLI is designed to:

• preserve hostile raw path bytes;
• invoke Git directly without a shell;
• disable repository fsmonitor hooks and optional locks for Git children;
• pass Git's global --no-lazy-fetch and --no-optional-locks options while retaining hardened environment values as defense in depth;
• make the explicit repository argument authoritative by removing inherited repository, index, object-store, worktree, replacement, ref-namespace, discovery, quarantine, command-configuration routing, and pathspec interpretation state from every Git child, using case-insensitive duplicate-safe matching;
• scan the whole selected repository and report repository-root-relative paths when the repository argument is its root or a same-filesystem directory inside its worktree;
• preserve unrelated child environment entries in stable order and avoid mutating the parent process environment;
• parse NUL-delimited metadata-only plumbing output without similarity, external-diff, or textconv execution;
• avoid file-content reads and runtime network access;
• avoid modifying, renaming, normalizing, or deleting repository paths;
• prevent raw ANSI, C0/DEL, bidi, selected invisible, invalid UTF-8, quote, and backslash bytes from escaping presentation boundaries;
• produce deterministic machine reports without local absolute paths or random metadata;
• preserve context cancellation and deadline identity internally while presenting at most one bounded, safely encoded diagnostic line on stderr.

Git-backed index, staged, and tree scans require Git 2.45 or newer. This is the minimum version that recognizes --no-lazy-fetch; older Git versions fail closed rather than running without the offline guarantee. --stdin0 does not invoke Git and remains available when Git is absent.

Repository and user diff.relative configuration, plus inherited GIT_LITERAL_PATHSPECS, GIT_GLOB_PATHSPECS, GIT_NOGLOB_PATHSPECS, and GIT_ICASE_PATHSPECS, are untrusted scope controls. Explicit top-level pathspecs, --no-relative, --full-tree, and child-environment isolation prevent them from narrowing a Git-backed scan or reinterpreting its scope. There is no subtree mode. A repository argument may be the root or a same-filesystem directory inside the selected worktree; if Git discovery would cross a mount boundary, pass the repository root. These rules do not change the raw paths supplied through --stdin0.

Tree scans honor standard refs/replace/ entries in the selected repository; inherited variables cannot disable them or select another replacement-ref base. Receive-hook scans that require objects still confined to Git's quarantine object directory are unsupported and fail closed. Run after object promotion or use --stdin0. The complete environment contract is recorded in ADR 0003, and the repository-wide scope contract is recorded in ADR 0004.

Resource-exhaustion findings, Git vulnerabilities, and filesystem-specific behavior outside the bounded model may still affect a run. See the limitations in README.md and docs/RULE_CATALOG.md.