I just mount .git read-only in my sandbox. That way I don't need to worry about it violating my safeguards.