Generally speaking, we proxy requests and pass them through to the VCS after performing authentication and broad permission checks. Requests are rewritten slightly to remap user-facing display paths to actual paths on disk. Some additional features act through commit hooks.