Are commits from local branches that aren't pushed accessible at the remote?

Say I have the following scenario:

Currently on master, do git checkout -b test.
Make some commits A and B in test.
Go back to master with git checkout master.
Make some commits C and D, then push to the remote master.

If this happens, from a security perspective are commits A and B accessible in any way to someone who views the remote repo? E.g., if they do a git clone and then try git checkout A, what would be the result?

Solution

Commits are only available in a repository after they have been pushed (or fetched). So no, unless you push your branch test (which contains commits A and B), they will not be available in the remote repository.

Note that if you created another branch off test (e.g. git branch demo test) and then push demo, the commits will be pushed – because both branches demo and test point to commit B, so the full history is going to be pushed.

If you only push master in your example, you are safe.