sandboxing 2 git-tools: why we pass values, not flags Aug 28, 2026 Hardening the background-command tool Aug 27, 2026