I'll also mention literally the first setup step to Git for most people: https://help.github.com/articles/set-up-git/ https://help.github.com/articles/set-up-gi

I'll also mention literally the first setup step to Git for most people: https://help.github.com/articles/set-up-git/ https://help.github.com/articles/set-up-git/ or similar. That might be a hint that Git isn't something which you should allow it to handle the security. Literally the first step to the entire thing: pick any email or name... Please provide reasonable security policies in your repos--and if someone is exploited, you've probably got far bigger problems than someone duplicating a sha-1. Not necessarily, but highly likely your system is owned.