GitHub and GitLab both do this. They only give you enough of a shell for Git commands. I'm not sure how GitHub's is implemented, but GitLab's used to be a locke

GitHub and GitLab both do this. They only give you enough of a shell for Git commands. I'm not sure how GitHub's is implemented, but GitLab's used to be a locked down Unix shell (i.e. in theory only the commands needed for Git would be accessible, with the caveat that there could be bugs) and now [0] it is a Go program [1] that listens for SSH connections and implements an in-process shell that only supports Git commands. Fun fact: you can create a GitLab PAT with an SSH command. (Another useful trick, to verify your SSH keys are configured properly for Git, is to run `ssh -T git@github.com` which will print a welcome message including your username.) [0] https://about.gitlab.com/blog/2022/08/17/why-we-have-implemented-our-own-sshd-solution-on-gitlab-sass/ https://about.gitlab.com/blog/2022/08/17/why-we-have-impleme... [1] https://gitlab.com/gitlab-org/gitlab-shell https://gitlab.com/gitlab-org/gitlab-shell