Round-3 audit residual R3 (LOW, not cut-blocker). The #241 content-store deny is git-only (.git/objects|modules|lfs). A committed secret in a Mercurial (.hg/store), Subversion (.svn/pristine) or Bazaar (.bzr) repo could be reconstructed via the respective VCS in Full-posture Bash. Fast-follow: extend the content-store deny set to the other VCS metadata dirs when present.
Round-3 audit residual R3 (LOW, not cut-blocker). The #241 content-store deny is git-only (
.git/objects|modules|lfs). A committed secret in a Mercurial (.hg/store), Subversion (.svn/pristine) or Bazaar (.bzr) repo could be reconstructed via the respective VCS in Full-posture Bash. Fast-follow: extend the content-store deny set to the other VCS metadata dirs when present.