lazygit is a terminal interface for git, written by a developer who was tired of being told how powerful git is while it stayed a pain to use. Run lazygit in a repository and you get panels for files, branches, commits and stashes, with every common action one key away: stage a single line or hunk, commit, push, pull, switch branches, stash, and see the diff of whatever is selected.
Where it really saves time is the work that is awkward on the git command line. Interactive rebase becomes moving commits up and down and pressing a key to squash, fix up, edit or drop them. Cherry-picking is copy and paste. You can amend an old commit, build a patch from parts of commits, bisect, manage worktrees, nuke the working tree, and undo most actions with z. It also shows which branches have GitHub pull requests when the gh CLI is set up.
It is a single Go binary under the MIT licence, with about 83,300 stars and 411 contributors, at v0.66.2 when scanned. It works over SSH and inside editors such as Neovim.
- Repository: github.com/jesseduffield/lazygit
- Licence: MIT (MIT License)
- Language: Go. Stars: 83.3K. Forks: 3,094. Last push: Oct 17, 2026.
- Scan: safe, Oct 19, 2026, commit 4e1eebe
Who it is for
Developers who live in the terminal, people who know what they want git to do but not the exact command, and anyone reviewing an AI agent's changes before committing them.
Getting started
1. macOS or Linux (Homebrew)
brew install lazygit2. Windows (winget)
winget install -e --id=JesseDuffield.lazygit3. Debian 13 or Ubuntu 25.10 and later
sudo apt install lazygit4. Open it inside any git repository
lazygitPress ? inside lazygit to see every key binding for the panel you are in. Go users can also install it with go install github.com/jesseduffield/lazygit@latest, and prebuilt binaries are on the releases page.
Safety scan
We cloned jesseduffield/lazygit at commit 4e1eebe on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no bare-IP URLs across 2,550 files and about 202,000 lines of Go.
- No install hooks; the one shell script runs the integration tests. The hosts in the code are git forges (GitHub, GitLab, Bitbucket, Azure DevOps, Gitea, Codeberg) used to build links to commits and pull requests, plus example domains in tests.
- 62 Go modules in go.mod with no known advisories.
- 5 workflows, none using pull_request_target, with all 5 third-party actions pinned to commits and Dependabot on. Its OpenSSF Scorecard is a modest 3.9 out of 10, mostly for review and branch protection checks. Licence and contributing guide present; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 5 workflows. None use pull_request_target. 0 of 5 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 21 distinct hosts referenced from source; most often github.com, gitlab.com, bitbucket.org, mycompany.bitbucket.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 0 advisories across 62 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. go.mod: 62 packages, 0 advisories. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | 3.9 out of 10, as of Oct 12, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- scripts/run_integration_tests.sh, 34 lines
By the numbers
| Stars | 83.3K |
|---|---|
| Forks | 3,094 |
| Contributors | 411 |
| Commits | 8,682 |
| Open issues | 864 |
| Open pull requests | 181 |
| Releases | 191 |
| Latest release | v0.66.2 |
| Licence | MIT |
| Main language | Go |
| Project age | 8 years |
| Last push | Oct 17, 2026 |
| Tracked files | 2,550 |
| Lines of code | 202.1K |
| Checkout size | 25 MB |
Lines by language: Go 170.7K, Markdown 15K, JSON 14.9K, YAML 728, Shell 678, Python 117.
Questions
Is lazygit free?
Yes. lazygit is MIT-licensed and free on every platform. The author accepts sponsorship through GitHub Sponsors, but nothing is locked behind it.
Do I still need to know git to use lazygit?
Some. lazygit makes git's actions easy to reach and shows you what each does, but it does not change git's model of commits, branches and rebases. It is a good way to learn that model, since you can see the effect of each action and undo it.
Does lazygit work with GitHub, GitLab and other hosts?
Yes. It works with any git remote, since it calls your own git. It can also open pull requests in the browser for the main forges and, with the gh CLI logged in, show which branches already have a GitHub pull request.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.