Quick demo: go to https://github.com/slimsag/linux/tree/5895e21f3c744ed9829e3afe9691e3eb1b1932ae#linux-kernel https://github.com/slimsag/linux/tree/5895e21f3c74

Quick demo: go to https://github.com/slimsag/linux/tree/5895e21f3c744ed9829e3afe9691e3eb1b1932ae#linux-kernel https://github.com/slimsag/linux/tree/5895e21f3c744ed9829e3a... then try replacing "slimsag" with "torvalds" These are "known issues" I believe GitHub doesn't intend to fix: 1. With youtube-dl[0] (and probably long before?) we know you can push a commit and view it under the web UI under another user, GitHub hasn't indicated this is a vulnerability at all. 2. Many people know you can impersonate another user through Git email addresses[1] (GPG signing is supposed to solve this, but a lot of people don't use it and even when they do others don't really know they should look for "Verified" in GitHub's web UI.) Combine these two known-issues and you get a really convincing phishing attack. I really hope this doesn't become a common-place thing. Hopefully this raises some awareness that, basically, you should not trust any GitHub URL with a commit SHA in it - only trust ones with branch names - because it could be a phishing attack otherwise. [0] https://news.ycombinator.com/item?id=24882921 https://news.ycombinator.com/item?id=24882921 [1] https://bounty.github.com/ineligible.html#impersonating_a_user_through_git_email_address https://bounty.github.com/ineligible.html#impersonating_a_us...