Repository-local config is Git settings stored inside a project, usually in that repository’s own configuration files, and applied only when Git operates in that workspace. These settings can affect branch rules, path handling, merge behavior, and other Git features for anyone who opens the repo.
It matters in security because repository-local settings are part of Git’s trust boundary. If an attacker can place malicious config in an untrusted project, they may influence how automated tools behave when they run Git commands to inspect the repo. In agentic coding tools, that can become a security issue even before code is executed, because the repository can shape the tool’s Git behavior during background scanning. Defenders reduce risk by treating repository settings as untrusted, disabling or restricting repo-controlled Git behavior where possible, and separating read-only inspection from actions that run inside the developer’s shell context.