[RFC] git-secure: add explicit authentication before push or clone

[Victor Duprez <duprezvictor4@gmail.com>]

Subject: [RFC] git-secure: add explicit authentication before push or clone
To: git@vger.kernel.org
From: Victor Duprez <duprezvictor4@gmail.com>

Hello Git community,

I would like to propose a new Git feature: a command called git-secure that prompts the user for authentication before executing sensitive Git operations such as git push or git clone.

Motivation:

Today, Git operations like push or clone can be executed as long as credentials (tokens or SSH keys) are available in the environment. While this is efficient, it presents some security risks:

- Users may inadvertently push changes without noticing.
- Machines may store tokens or SSH keys in accessible locations.
- In the case of theft or shared systems, these credentials could be silently misused.

Proposal:

Introduce a git-secure command (or option) that prompts the user interactively for either:

- A GitHub personal access token
- A simple password generated by a secure third-party password manager (optionally linked via API)

This token or password would be used only once, then securely discarded from memory and disk. It would provide an optional extra layer of control and security over Git operations, especially when working in untrusted environments.

Prototype:

A working prototype script is available here:
https://github.com/VictorNafs/git-secure-hub

Example usage:

$ ./git-secure.sh
Enter your GitHub token or generated password:
GitHub username:
Operation (push/clone):

Thank you for your time and feedback.