Credentials end up in the repo to be cloned

[jensklose]

Further research needed! I got this issue on an empty repo and a credential helper with a mounted store.

$ git clone http://localhost:3000/jens/store-team1.git
Cloning into 'store-team1'...
Username for 'http://localhost:3000': jens
Password for 'http://jens@localhost:3000':
⚠ Failed to pull before git push: exit status 1: fatal: couldn't find remote ref master
warning: You appear to have cloned an empty repository.
$ cd store-team1/

$ git status
On branch master
Your branch is based on 'origin/master', but the upstream is gone.
  (use "git branch --unset-upstream" to fixup)

Changes not staged for commit:
  (use "git add/rm <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
        deleted:    git/localhost_3000/jens.gpg

no changes added to commit (use "git add" and/or "git commit -a")

[varac]

I encountered the same today, which is really worrysome, because I am using a public dotfiles repository and the (ok, gpg-encrypted) password was automatically pushed. So I needed to force-push to my public (protected) main branch, so yeah.
Please look into this, meanwhile I'll stop using this otherwise awesome git integration and use a local unencrypted git credential store until this get fixed. Thanks!

[varac]

And probably this already affects other users as well, since pushing is transparent and you don't really notice easily that sth leaked.

[dominikschulz]

I'm afraid, but I don't use this myself and don't have a lot of time right now.
This will need some help.