I agree in binary formats, it's easier to accomplish, but it by no means is easy. Thankfully most source code is plain text. There are mostly trivial ways to

I agree in binary formats, it's easier to accomplish, but it by no means is easy. Thankfully most source code is plain text. There are mostly trivial ways to encode information in whitespace/etc, but again, the ability to carry some useful information AND commit a SHA1 collision is currently non-trivial. Plus Git has specifically put in some hardening for the existing SHA1 hashes to make this even less feasible in the particular application of a git repo. A pipe wrench to the back of the head(or social engineering) of some random committer is probably a LOT easier to accomplish. That said, if your primary nemesis is one the giant nation states(US, China, Russia, Etc) AND you were very high target for them, then all bets are off, as they can pretty much accomplish whatever they want against any individual/small group on the planet. I would imagine most of us are not even remotely in this situation.