github.com/go-gitsafe/gitsafe

Guards that do not rely on remembering: a global git hook refusing a credential in a remote URL and a write to the default branch, plus a credential helper, a scope checker, and a wrapper that never touches the token