Let me know how you'd like to resolve this issue. We could just force the directory to be a realpath, and then ensure it is a subdirectory of `/home/git`. Would maybe break symlinks, but I don't think we can do much against people fucking that up.