3 ms·
The problems here come from the fact that a "merge" commit is just a normal commit with multiple parents. This means that anything can happen inside that merge
by georgyo 4y ago
The problems here come from the fact that a "merge" commit is just a normal commit with multiple parents.
This means that anything can happen inside that merge commit, including add, remove, and modify all the code, even if not touched by a parent.
Merge commits are good place for a malicious actor to hide changes.