Git config is the set of repository-level, user-level, and system-level settings that control how Git behaves. It can define defaults for remote access, merge behavior, credential helpers, hooks-related options, and other helper programs that Git may invoke while processing a repository.
In security terms, Git config matters because it can influence execution, not just preferences. A malicious repository may include settings that cause Git or a calling tool to run a helper command when the workspace is inspected. If an AI coding agent or automation runs Git before sandboxing or approval checks, that command may execute on the developer’s machine with the user’s privileges. Defenders should treat repository-controlled Git settings as untrusted input, restrict helper execution, and make sure any Git operation on unfamiliar code happens inside explicit approval and isolation boundaries.