Module export_key 

git-xcrypt export-key — hand the repository key to the user, once.

This is the command that gives a key away, so it is the shortest route to a leak in the whole product. PRD FR-007 says as much: “one run inside CI, or one redirect into the repository directory, is all it takes”. Three refusals close the routes that do not need a compromised machine:

• the key reaches stdout only when --stdout asks for it, and never when stdout is a terminal — a key in the scrollback outlives the window, the multiplexer’s buffer and often the session log. Added 2026-08-06 for the one workflow the file form cannot serve: piping the key straight into a secret store (| pbcopy, | gh secret set …) without it ever touching the disk. What that flag cannot police is a shell redirect: --stdout > secrets/key.txt writes where the refusals below would have said no, because a process cannot portably learn the path behind its own file descriptor. Said out loud in the command’s own warning and in the README, because it is the FR-007 leak with the guard rail removed by hand;
• a destination inside the working tree is refused outright, because that is one git add -A away from a commit;
• an existing file is refused unless --force, so a mistyped path cannot silently destroy someone’s backup of a different key.

The file itself is written owner-only and atomically, by the same code that writes the repository’s own key.

Structs

Report

What export-key wrote, so the binary can say so without naming the key.

Functions

run

Writes the repository key to destination.

to_stdout

Writes the repository key to stdout, for piping into a secret store.