@@ -21,10 +21,12 @@
 """
 from __future__ import annotations
 
+import base64
 import contextlib
 import json
 import os
 import shutil
+import stat
 import subprocess
 import sys
 import tempfile
@@ -266,40 +268,84 @@ def build_local_snapshot(
 # ---------------------------------------------------------------------------
 
 
+GIT_TIMEOUT_SECONDS = 300
+
+
+def _git_auth_env(token: str) -> dict[str, str]:
+    """Credentials for github.com passed through git's environment-config
+    channel (``GIT_CONFIG_COUNT``/``KEY``/``VALUE``) instead of the clone URL,
+    so the token never appears in argv, the process list, ``.git/config`` or
+    error messages."""
+    basic = base64.b64encode(f"x-access-token:{token}".encode()).decode()
+    return {
+        "GIT_CONFIG_COUNT": "1",
+        "GIT_CONFIG_KEY_0": "http.https://github.com/.extraheader",
+        "GIT_CONFIG_VALUE_0": f"AUTHORIZATION: basic {basic}",
+    }
+
+
+def _redact(text: str, secrets: tuple[str, ...]) -> str:
+    for secret in secrets:
+        if secret:
+            text = text.replace(secret, "***")
+    return text
+
+
 def _run_git(
     args: list[str],
     *,
     cwd: Path | None = None,
     env: dict[str, str] | None = None,
     check: bool = True,
+    redact: tuple[str, ...] = (),
 ) -> subprocess.CompletedProcess:
     """Thin wrapper around git subprocess for testability and uniform
     error handling. Uses ``GIT_TERMINAL_PROMPT=0`` to fail fast on auth
-    issues instead of hanging for input."""
+    issues instead of hanging for input, and a timeout so a stalled
+    network clone cannot block the job indefinitely. Any value in
+    *redact* is masked in error messages."""
     full_env = {**os.environ, "GIT_TERMINAL_PROMPT": "0"}
     if env:
         full_env.update(env)
-    result = subprocess.run(
-        ["git", *args],
-        cwd=str(cwd) if cwd else None,
-        env=full_env,
-        capture_output=True,
-        text=True,
-    )
+    try:
+        result = subprocess.run(
+            ["git", *args],
+            cwd=str(cwd) if cwd else None,
+            env=full_env,
+            capture_output=True,
+            text=True,
+            timeout=GIT_TIMEOUT_SECONDS,
+        )
+    except subprocess.TimeoutExpired:
+        raise RemoteSnapshotError(
+            _redact(f"git {' '.join(args)} timed out after {GIT_TIMEOUT_SECONDS}s", redact)
+        ) from None
     if check and result.returncode != 0:
         raise RemoteSnapshotError(
-            f"git {' '.join(args)} failed (rc={result.returncode}): "
-            f"{result.stderr.strip() or result.stdout.strip()}"
+            _redact(
+                f"git {' '.join(args)} failed (rc={result.returncode}): "
+                f"{result.stderr.strip() or result.stdout.strip()}",
+                redact,
+            )
         )
     return result
 
 
-def _scrub_token_from_remote(repo_dir: Path, owner: str, slug: str) -> None:
-    """After clone, replace the token-bearing remote URL with a clean one.
-    Defense-in-depth: prevents the token from leaking via subsequent ``git
-    remote -v`` calls or accidental ``.git/config`` exposure."""
-    clean_url = f"https://github.com/{owner}/{slug}.git"
-    _run_git(["remote", "set-url", "origin", clean_url], cwd=repo_dir, check=False)
+def _force_remove_readonly(func, path, _exc) -> None:
+    """rmtree error hook: git pack files are read-only on Windows, so clear
+    the bit and retry once."""
+    try:
+        os.chmod(path, stat.S_IWRITE)
+        func(path)
+    except OSError:
+        pass
+
+
+def _rmtree(path: Path) -> None:
+    if sys.version_info >= (3, 12):
+        shutil.rmtree(path, onexc=_force_remove_readonly)
+    else:  # pragma: no cover - older interpreters
+        shutil.rmtree(path, onerror=_force_remove_readonly)
 
 
 @contextlib.contextmanager
@@ -317,7 +363,7 @@ def _sparse_clone(
         token = gh_token.strip()
         if not token:
             raise RemoteSnapshotError(f"gh_token is empty for {owner}/{slug}")
-        clone_url = f"https://x-access-token:{token}@github.com/{owner}/{slug}.git"
+        clone_url = f"https://github.com/{owner}/{slug}.git"
         clone_args = [
             "clone",
             "--filter=blob:none",
@@ -327,8 +373,7 @@ def _sparse_clone(
         if branch:
             clone_args += ["--branch", branch]
         clone_args += [clone_url, str(tmp)]
-        _run_git(clone_args)
-        _scrub_token_from_remote(tmp, owner, slug)
+        _run_git(clone_args, env=_git_auth_env(token), redact=(token,))
         # `--no-cone` lets us mix file-level patterns (AGENTS.md, CLAUDE.md)
         # with directory patterns (skills, rules). Cone-mode is the default
         # since git 2.35 and rejects file patterns. The deprecation warning
@@ -340,7 +385,7 @@ def _sparse_clone(
         )
         yield tmp
     finally:
-        shutil.rmtree(tmp, ignore_errors=True)
+        _rmtree(tmp)
 
 
 def build_remote_snapshot(
 
@@ -22,7 +22,6 @@
 from scripts.drift_check.snapshot import (
     SPARSE_PATHS,
     RemoteSnapshotError,
-    _scrub_token_from_remote,
     build_remote_snapshot,
 )
 
@@ -64,7 +63,6 @@ class _Result:
 def test_remote_snapshot_issues_correct_git_commands(tmp_path: Path):
     fake = _FakeRun([
         (0, "", ""),  # clone
-        (0, "", ""),  # remote set-url (token scrub)
         (0, "", ""),  # sparse-checkout set
     ])
     # Patch tempfile so we know exactly which tempdir gets used.
@@ -93,20 +91,19 @@ def test_remote_snapshot_issues_correct_git_commands(tmp_path: Path):
     assert "--filter=blob:none" in clone_args
     assert "--sparse" in clone_args
     assert "--depth" in clone_args
-    # Token must be in the clone URL
+    # Token must never be in argv; it travels in the env-config header.
+    assert "ghp_test" not in " ".join(clone_args)
     url = [a for a in clone_args if a.startswith("https://")]
-    assert url and "ghp_test" in url[0]
-    assert "github.com/TMHSDigital/CFX-Developer-Tools.git" in url[0]
-
-    # Verify token scrub is the second call
-    scrub_args = fake.calls[1][0]
-    assert scrub_args[1] == "remote"
-    assert scrub_args[2] == "set-url"
-    assert "ghp_test" not in " ".join(scrub_args)
+    assert url == ["https://github.com/TMHSDigital/CFX-Developer-Tools.git"]
+    clone_env = fake.calls[0][1]["env"]
+    assert clone_env["GIT_CONFIG_KEY_0"] == "http.https://github.com/.extraheader"
+    assert clone_env["GIT_CONFIG_VALUE_0"].startswith("AUTHORIZATION: basic ")
+    assert "ghp_test" not in clone_env["GIT_CONFIG_VALUE_0"]
+    assert fake.calls[0][1]["timeout"] > 0
 
     # Verify sparse-checkout uses --no-cone (required for file-level
     # patterns like AGENTS.md) and includes all SPARSE_PATHS
-    sparse_args = fake.calls[2][0]
+    sparse_args = fake.calls[1][0]
     assert sparse_args[1] == "sparse-checkout"
     assert sparse_args[2] == "set"
     assert "--no-cone" in sparse_args
@@ -136,7 +133,6 @@ def test_remote_snapshot_cleans_up_on_clone_failure(tmp_path: Path):
 def test_remote_snapshot_cleans_up_on_sparse_failure(tmp_path: Path):
     fake = _FakeRun([
         (0, "", ""),         # clone OK
-        (0, "", ""),         # scrub OK
         (1, "", "bad path"),  # sparse-checkout FAIL
     ])
     sparse_dir = tmp_path / "sparse"
@@ -169,13 +165,24 @@ def test_remote_snapshot_rejects_empty_token(tmp_path: Path):
     assert not sparse_dir.exists()
 
 
-def test_scrub_does_not_raise_on_failure(tmp_path: Path):
-    """Scrub is best-effort. If git remote set-url fails for some reason
-    (e.g., the clone partially succeeded), the snapshot still completes."""
-    fake = _FakeRun([(1, "", "no remote")])
-    with patch("scripts.drift_check.snapshot.subprocess.run", fake):
-        # Should not raise
-        _scrub_token_from_remote(tmp_path, "TMHSDigital", "x")
+def test_clone_failure_message_never_contains_token(tmp_path: Path):
+    """git can echo the remote or auth details on failure; the raised
+    error must mask the token either way."""
+    fake = _FakeRun([(128, "", "fatal: auth failed for ghp_secret_value")])
+    sparse_dir = tmp_path / "sparse"
+    sparse_dir.mkdir()
+    with patch("scripts.drift_check.snapshot.subprocess.run", fake), \
+         patch("scripts.drift_check.snapshot.tempfile.mkdtemp", return_value=str(sparse_dir)):
+        with pytest.raises(RemoteSnapshotError) as exc_info:
+            build_remote_snapshot(
+                repo_slug="x",
+                meta_version=META,
+                meta_commit="sha",
+                config=_cfg(),
+                gh_token="ghp_secret_value",
+            )
+    assert "ghp_secret_value" not in str(exc_info.value)
+    assert "***" in str(exc_info.value)
 
 
 @pytest.mark.skipif(