A Git hook is an executable script that runs automatically when Git reaches certain repository events, such as commit creation, merge checks, push validation, or server-side updates. Hooks can be local to a developer’s machine or managed by a Git server, and they are often used to enforce policy, generate artifacts, sign releases, or reject unwanted changes before they land.
Git hooks matter in cyber security because they sit at the boundary between code content and command execution. If an attacker can influence a hook, replace one, or trick a platform into treating user-supplied data as a hook, they may gain arbitrary code execution under the account that runs Git or the hosting service. Defenders therefore treat hook paths, permissions, and server-side validation as sensitive controls. Common protections include limiting who can write hooks, running services with least privilege, and reviewing hook activity for unexpected shell commands.