A push option is an optional parameter sent with a Git push to tell the server how to handle that push. Git supports these values as part of the protocol, often through --push-option, so automation and repository workflows can pass metadata without changing the code being pushed.
Security matters because push options cross a trust boundary: they are user-controlled input that may be parsed by server-side services, hooks, or internal handlers. If that input is not validated and sanitized, it can be abused to alter behavior, inject delimiters, or reach unsafe command contexts. In attacks, the risk is usually not the push itself but the way the server processes attached metadata. Defenders should treat push options as untrusted data, restrict who can use them, validate their format, and review logs for unusual values or patterns.