Ok so apparently cloning/fetching git repos owned by a different user on a local filesystem is not safe:
https://github.com/git/git/commit/f4aa8c8bb11dae6e769cd930565173808cbb69c8
so... how do y'all get commits from the user a service runs as to the user that has an ssh key and can push to remotes?