[darau1]

That's terrifying. I'll think twice before cloning any repository from now on.

> not disabled by default yet

You're saying there's a way to "disable" this behavior?

[joeyh]

Set safe.bareRepository = explicit.

[jwilk]

Available since Git v2.38:

https://github.com/git/git/commit/8d1a7448206e11cd

[tomlx]

none that i know of