Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private information there, such as my username, my email, command history, or perhaps some secrets?
The contents of your .git repository may contain loose objects that you may not want to share (e.g. something you committed but changed your mind and deleted/amended), so there is no definite "yes, this is safe."
A better way to share git repositories offline is to create a bundle file and send that to your friend, e.g.:
git bundle create /tmp/myrepo.bundle --all
Then you can send myrepo.bundle to your friend and they can clone from it like they would from any remote:
git clone myrepo.bundle
That would be a better way to make sure that you're not sharing loose objects that aren't intended to be seen by others.
Is it safe for me to send him the
One place you would need to be careful is that sharing your entire
.git folder would include
.git/config. Depending on what you've done, this could have very little information, or quite a lot. If all you've done is a clone, there won't be much more than your list of remotes. If you've worked extensively in the repository, however, there might be things like aliases or configuration settings, as well as a partial record of what branches you've pushed (more specifically, what tracking branches you have configured). Worse, if you've set up any access credentials (e.g. for code review or CI) that are stored in the local
.git/config, those would be leaked.
Beyond this, see the other answers.
All that said, however, I don't believe you would need to send the
.git/config anyway. However, sending a bundle is going to be much safer, as well as more reliable, so the short answer is that you just shouldn't send your
.git folder in any case. Not just for security/privacy, but for ease of use also.
Is there any private information there, such as my username
Your local machine username should only be present in a repository if you have not configured your git identification. In this case, git defaults to something like
$(id)@$(hostname), which will be recorded if you commit anything. This might be especially relevant if you commit something, realize you need to set your identification, and amend the commit, as the old commit may still be present until it gets garbage-collected.
Your e-mail is part of a git commit's authorship record. If you've pushed to a public repository, that's already out there. Note that even if you change the author, the committer is a separate record. See also the previous paragraph.
command history, or perhaps some secrets?
If there are any secrets in your
.git/config, these might be leaked.
Your command history won't be directly leaked. However, it may be possible to infer your command history, at least as far as (some) git commands, via careful analysis of the contents of the
.git folder. Note that this is partly true for public repositories as well, although it is much harder to impossible there to uncover anything other than commits and merges. The difference mainly comes down to your
.git folder will contain artifacts from commits that have been amended, rebases, abandoned branches, and so forth.
Realistically speaking, other than maybe your
.git/config, a local
.git folder which is a clone of a public repository will rarely contain anything you're likely to truly consider "sensitive" unless you accidentally committed something that definitely is sensitive. In most cases, however, if you don't mind someone seeing the "official" history, you probably aren't likely to mind if they can see where/how that history has been created/edited, unless you have a near-pathological need to maintain an appearance of tidiness.
...but again, just use a bundle. The tiny amount of extra effort on your part — if any; you'd still have to pack up the
.git folder contents somehow — is canceled out by how much easier it is for your recipient to use a bundle, and on top of that you won't be worried about leaking sensitive information.
It depends on what you were doing. E.g. there can be files that you have deleted afterwards that contain some sensitive data.
You are not the first one who asks such question. Look at the Git documentation, chapter Removing sensitive data from a repository. It describes what should you care of, what tools and what specific commands you can use to remove possible sensitive data.