Not every ZIP. The ones from repositories that fail a 22-check trust verdict — held while the verdict is fetched, cancelled before they reach your downloads folder.
What it gates. The Download ZIP button, release-asset archives and installers, Save Link As, and archive URLs you paste into the address bar. Chrome and Edge, from one store listing. What it does not see: git clone, package managers, curl, Docker builds, or an AI agent fetching on its own. A browser extension cannot observe other processes, and we print that here rather than let you find out.
A blanket blocker — every GitHub download, or every ZIP — protects nobody, because it is turned off by lunchtime. The FakeGit campaign of 2026 shows what a blocker has to distinguish: roughly 7,600 repositories that looked ordinary, on 6,600 fabricated accounts, shipping a trojan as a release ZIP that was downloaded 14,084,688 times. The source tree was clean. The README was fine. The account was three weeks old and the asset was a .zip the source did not explain. A blocker has to read that, and only that.
When a download starts from a GitHub repository, the extension holds it and asks the verdict service about owner/repo — that string and nothing else. The service runs the 22 checks: who owns the repository and since when, whether the stars match the history, what is attached to the releases, what runs when the folder is opened, what an AI agent would read first. The answer comes back in a few seconds as PASS, REVIEW or BLOCK with the findings that produced it. A PASS proceeds. A REVIEW holds the download and shows you the findings; proceeding is one click, and recorded. A BLOCK is cancelled before the file reaches your downloads folder. Repositories on the active campaign list are blocked ahead of everything — including your own allowlist.
Two details we state because they matter. The transfer itself begins while the gate deliberates — the browser streams bytes to a temporary file; what RepoGates stops is the file reaching its final path, not the first byte reaching the machine. And if the verdict service cannot be reached, the default policy fails closed: the download is cancelled and the page says why. You can choose fail-open. Cached verdicts and the campaign list resolve without any service call.
Every check has a published weight and a measured false-positive rate. The default policy blocks on a maintainer account under 90 days old — 45 points, and it blocked none of the top 100 repositories in our controls — and on content findings inside agent configuration: hidden Unicode in a rules file, an MCP config that launches a shell, a credential redirect. It warns on the things legitimate projects routinely do: a binary release asset (95% of legitimate tools that ship a program fire it), a devcontainer that runs on open (28.8% of the top 100 carry one), a setup.py. Those show you the finding and let you decide, and the decision is yours.
| Verdict | What it means | What happens to the download |
|---|---|---|
| PASS | No check fired at a level your policy acts on. Not a guarantee. | Proceeds. |
| REVIEW | Findings worth reading — a young account, an auto-executing devcontainer, a binary asset. | Held; findings shown; proceed with one click, recorded on your machine. |
| BLOCK | A finding your policy blocks on, or a repository on an active campaign list. | Cancelled before it reaches your downloads folder. Overridable unless campaign-listed. |
Over 800 of the FakeGit repositories posed as AI Skills or MCP servers so that Claude, Gemini and ChatGPT would recommend them. If an AI surface led you to the repository — an assistant, or an MCP directory — RepoGates knows, because the fact exists only in the browser at navigation time. A repository that would otherwise warn is blocked; the decision page says an AI surface sent you. Only the surface's hostname is sent, never the conversation. The technique is called AgentBaiting; the check is C22.
| Gated | Not seen |
|---|---|
| The Download ZIP button | git clone, gh repo clone |
| Release-asset archives and installers — the FakeGit path | npm install, pip, go get, curl |
| Save Link As and pasted archive URLs | Docker builds |
| Chrome and Edge, one listing | Firefox and Safari |
| A repository an AI assistant led you to | An AI agent that fetches code on its own |
Does a GitHub download blocker stop git clone? No. A browser extension sees browser downloads — the Download ZIP button, release-asset archives, Save Link As, pasted archive URLs. It does not see git clone, package managers, curl, Docker builds, or an AI agent fetching on its own — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs, and sees Bash tool calls in that one client and nothing else. RepoGates says so on every page rather than let you find out.
Can I override a block? Yes, unless the repository is on an active malware campaign list. A warning shows the findings and a Proceed button; a block can be overridden once or the repository allowlisted permanently. Every override is recorded on your machine with the verdict it overrode.
What happens if the verdict service is unreachable? The default policy fails closed: the download is cancelled and the decision page says the service could not be reached. You can switch the policy to fail open. Repositories already known — cached verdicts and the campaign list — still resolve with no service call.
Add RepoGates to Chrome or Edge The personal guide
Free to start: 10 repositories within 14 days, no card. Personal is $29 a year. Numbers on this page: Island and BleepingComputer, July 2026; our own Phase 0 measurement of 14 August 2026 — including the correction that made our number smaller.