Trust zones for project root discovery

[noktoborus]

I start helix in /home/$USER/current/work/dir, then helix search .helix and .git directories if not found in current:

/home/$USER/current/work/(.git|helix)
/home/$USER/current/(.git|helix)
/home/$USER/(.git|helix)
/home/(.git|helix)
/(.git|helix)

I am not sure seaching outside of /home/$USER makes sense and does not looks secure.

What is the best way to limit the search project's root and config directories in trusted zone?