The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option.
The "GitBleed" issue can't be fixed, because it requires basic user education and can be fixed only by administrators responsible for individual repositories by analyzing a fuller copy of their own repositories using the “–mirror” option and remove sensitive data using tools like BFG or git-filter-repo.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):