Git's workflow makes first-preimage attacks dangerous, because a mallicious third-party may submit a pull-req to your repo that contains files for which they've

Git's workflow makes first-preimage attacks dangerous, because a mallicious third-party may submit a pull-req to your repo that contains files for which they've pre-generated a collision: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-February/013600.html https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017... Git is vulnerable to SHA1 collisions in standard development workflows.