## Lesson — Block leading hyphens in Git ranges

**Tags:** git, security
**Scope:** packages/core/src/sys/git.ts

Validate that user-provided Git ref ranges do not start with a hyphen to prevent flag injection, even when using safe execution with argument arrays.
