posthooks/gitattributes-filter?
- .ssh/config: make read-only (git will drop this perms normally)