Meanwhile, in JJ, per-repo config is also stored in ~/.config, to avoid this attack:

https://www.jj-vcs.dev/latest/design/secure-config/