Every object is encrypted on your machine before it leaves it. The server stores ciphertext under opaque IDs and holds no key to any of it — not to your files, not to your filenames, not to your commit messages, not even to the name of the repository.
Same repository, both sides. The right column is everything we could hand over if we were asked to, or breached.
How it works
A remote helper handles zkgit:// URLs, so git push and git clone work the way they always have. Branching, merging and rebasing happen in your local git, on plaintext, untouched by any of this.
# after `zkgit repo create`, this is just git
git push origin main
Each git object is encrypted with XChaCha20-Poly1305 under a key only you hold, and filed under an HMAC of its hash — so the server never sees a real SHA either. Fetching re-hashes every object and refuses anything that doesn’t match what was asked for.
Inviting someone seals the repo key to their public key alone, after you’ve confirmed their fingerprint out of band. Removing them re-encrypts the entire repository under a fresh key, so the copy they can still reach stops opening.
zkgit repo invite <server> pricing-engine RYU2-45PU-IYK7-LACK write zkgit repo revoke <server> pricing-engine RYU2-45PU-IYK7-LACK
The honest ledger
Encryption hides content, not the fact that content exists. Here is the whole list, including the parts that aren’t flattering.
Before you ask for an invite
There is no reset, no support override, no backdoor. That isn’t a policy we could change under pressure — there is simply no key on our side to use.
Someone who already cloned a repository still has that clone. Revocation re-keys everything from that moment forward; it can’t reach into a laptop, and we won’t build something that can.
Priorities in order: security, then privacy, then convenience, and anonymity last — best-effort, never absolute. Someone watching the network still learns that you talk to this server and roughly how much you push.
It is tested end to end and used daily by the person who wrote it, which is not the same as being proven. Keep another copy of anything you can’t lose.
Invite only, for now
Tell us what you’d use it for. Invites go out in batches, and you’ll get a single-use code that works with zkgit signup. The email you write from is never linked to the account you create — we can’t match them up afterwards, and that’s on purpose.