Not all that much. If I hack your SVN repository, I put something like "if ($password == "1337h4xx0r") $admin = 1" into an old revision and hope you don't notic

Not all that much. If I hack your SVN repository, I put something like "if ($password == "1337h4xx0r") $admin = 1" into an old revision and hope you don't notice it when inspecting code. If I hack your git repository, I make a commit with text "spelling fix: invole -> involve" and slip in something like the above. Yes, it's a bit easier to detect, but not all that much - most such breaches seem to be found by system administrators before the developers notice them. (The kernel.org source code breach was detected because some mirror failed to line up with the main repository, for instance) Of course, a smart hacker would do something less obvious. See the obfuscated C contest for inspiration. And again, this assumes that I do not have any other access. In reality, I could change your $PATH to invoke a trojaned git binary, or somesuch.