&gt; It bypasses SIP<p>No it doesn&#x27;t. Why are you claiming it does? &#x2F;usr&#x2F;bin&#x2F;git and the other shims are behaving precisely as expected. There is absolutely no violation of SIP. Someone who is able to muck with DEVELOPER_DIR or install a fake xcrun does not gain any privileges by doing so, and they&#x27;re already in a position to do whatever malicious act you&#x27;re thinking they&#x27;d trigger by invoking &#x2F;usr&#x2F;bin&#x2F;git.