I went through the source code and it looks solid overall. No telemetry, no license enforcement, and the input sanitization is generally careful (the clone URL validation rejects ext:: and http, and open_url is restricted to http/https/mailto).

A few things I noticed: there is an automatic update check on startup that contacts api.github.com (in crates/gitcomet-ui-gpui/src/view/update_check.rs). It can be disabled with GITCOMET_NO_UPDATE_CHECK, but it is on by default. Not telemetry, but worth being aware of.

Credentials (SSH passphrases, tokens) are passed to child Git processes via environment variables rather than stdin or a credential helper. That is visible to same-user processes via /proc/<pid>/environ on Linux, though I did not find any disk persistence of secrets.

The unsafe_code = "forbid" workspace lint is a nice touch, but it does not apply uniformly -- gitcomet-tree-sitter-alloc and the excluded win32-window-utils crate both contain unsafe blocks. The unsafe code there is narrow and understandable (allocator hooks, Win32 FFI), but the claim is not quite absolute.

On the YAML: the price field says "Free", but the website advertises a paid Professional tier at EUR 20. Other entries that have a freemium model reflect that in the price field. Might want to update this for accuracy. Also, the license field says "AGPL-3.0 license" -- on git-scm.com, existing entries use shorter forms like "MIT" or "GPLv2". Maybe just "AGPL-3.0".