Add security notice about args option

jaz303 · Mar 28, 2022 · fd33045 · fd33045
1 parent 1f00fa8
commit fd33045
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -25,6 +25,9 @@ As of 0.2.0 there's a promised-based API for use with `async`/`await`:
   * `checkout`: revision/branch/tag to check out after clone
   * `args`: additional array of arguments to pass to `git clone`
 
+**NOTE:** the `args` option allows arbitrary arguments to be passed to `git`; this is inherently insecure if used in
+combination with untrusted input. **Only use the `args` option with static/trusted input!**
+
 ## Callback
 
 #### `clone(repo, targetPath, [options], cb)`