An unfamiliar repository may be completely legitimate. It still contains code and configuration written by someone else. What should you check before installing dependencies, running builds or tests, and how can you limit the risk when using IDEs, coding agents, and Git itself?
