diff --git a/_vcsh b/_vcsh
index 3022c6125d6a4a82db9697ee76a5f7c229d12f95..bc1a7b95a490ff7951439f3346aaef0495b71fb5 100644
--- a/_vcsh
+++ b/_vcsh
@@ -95,6 +95,9 @@ function _vcsh () {
 	local state vcshcommand
 	local -a args subcommands
 
+	local VCSH_REPO_D
+        : ${VCSH_REPO_D:="${XDG_CONFIG_HOME:-"$HOME/.config"}/vcsh/repo.d"}
+
 	subcommands=(
 		"clone:clone an existing repository"
 		"commit:commit in all repositories"
@@ -135,7 +138,7 @@ function _vcsh () {
 			if ! (( ${+functions[_vcsh-$vcshcommand]} )); then
 				# There is no handler function, so this is probably the name
 				# of a repository. Act accordingly.
-				_dispatch git git
+				GIT_DIR=$VCSH_REPO_D/$words[1].git _dispatch git git
 			else
 				curcontext="${curcontext%:*:*}:vcsh-${vcshcommand}:"
 				_call_function ret _vcsh-${vcshcommand}
diff --git a/t/100-init.t b/t/100-init.t
index 74facc02655ba9db6b733c754d6685b61d43813d..15ce922f0e32040dae47cb795653567b8a90a2b7 100644
--- a/t/100-init.t
+++ b/t/100-init.t
@@ -18,7 +18,7 @@ ok $output eq "", 'No repos set up yet.';
 
 $output = `./vcsh init test1`;
 
-ok $output eq "Initialized empty shared Git repository in " . $ENV{'HOME'} . "/.config/vcsh/repo.d/test1.git/\n";
+ok $output eq "Initialized empty Git repository in " . $ENV{'HOME'} . "/.config/vcsh/repo.d/test1.git/\n";
 
 $output = `./vcsh status`;
 
diff --git a/vcsh b/vcsh
index 8052083dbc12015919e8c4d7c5c70730c1a6d381..f06f5b456985dda6269b3541195b0e2c2c34fe6a 100755
--- a/vcsh
+++ b/vcsh
@@ -22,6 +22,9 @@
 VERSION='1.20141026'
 SELF=$(basename $0)
 
+# Ensure all files created are accessible only to the current user.
+umask 0077
+
 fatal() {
 	echo "$SELF: fatal: $1" >&2
 	[ -z $2 ] && exit 1
@@ -263,7 +266,7 @@ init() {
 	[ ! -e "$GIT_DIR" ] || fatal "'$GIT_DIR' exists" 10
 	mkdir -p "$VCSH_BASE" || fatal "could not create '$VCSH_BASE'" 50
 	cd "$VCSH_BASE" || fatal "could not enter '$VCSH_BASE'" 11
-	git init --shared=0600
+	git init --shared=false
 	upgrade
 	hook post-init
 }