When conducting penetration tests on Git repositories, focus on common weaknesses like exposed .git directories, inadequate access controls, and improper management of secrets within the codebase. Tools like gitrob and truffleHog can help identify sensitive data in repositories. Also, check for oversight in branch protection and audit commit histories for leaked credentials. Always ensure you have explicit permission before testing. For further learning, OWASP’s GitHub Security Best Practices offers valuable guidance.