Please do not publish a repository-corruption or command-injection report as a public issue before it can be evaluated.

Use GitHub's private vulnerability reporting for this repository when available. Include the ByeClaude version, Git version, operating system, repository shape that reproduces the problem, the exact command, and whether the failure happened before or after ref updates.

ByeClaude is a history-rewriting tool. Always keep an independent remote or clone for repositories whose history cannot be reconstructed.