diff --git a/app/git.js b/app/git.js
index b67814a..87ec0c9 100644
--- a/app/git.js
+++ b/app/git.js
@@ -1,9 +1,12 @@
-import { execSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import path from 'path';
 import { GITEA_SERVER_URL, GITEA_REPOSITORY, GITEA_TOKEN, PR_HEAD_BRANCH, FINDINGS_PATH } from './config.js';
 
 function git(args, cwd) {
-  return execSync(`git ${args.map(a => `'${a.replace(/'/g, "'\\''")}'`).join(' ')}`, { cwd, encoding: 'utf8' }).trim();
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error((result.stderr || result.stdout || '').trim());
+  return (result.stdout || '').trim();
 }
 
 export async function commitAndPush(workspace) {