A working tree is the set of files a repository has actually checked out on disk after a fetch, clone, sync, or checkout operation. It is the local, editable copy of the code that tools and users run, inspect, and modify. In Git-based systems, the working tree is distinct from the commit reference or tag that names the intended version.
In cyber security, the working tree matters because trust depends on what is really installed, not just what was selected. Attackers can exploit gaps between a pinned reference and the final on-disk state by swapping content, re-resolving branches, or changing files after review. Defenders therefore verify that the working tree matches the expected commit or digest before execution. This is important in software supply chains, plugin systems, and AI coding agents that automatically download and run code with user privileges.