So just so I'm clear based on what you've mentioned, even the policy prohibiting 40 hex character tags isn't doing anything to stop a tage the same as the short

So just so I'm clear based on what you've mentioned, even the policy prohibiting 40 hex character tags isn't doing anything to stop a tage the same as the short commit ID? Also, per this comment on a previous discussion on this incident at https://news.ycombinator.com/item?id=43367987#43369710 https://news.ycombinator.com/item?id=43367987#43369710: > the real renovate bot immediately took the exfiltration commit from the fake renovate bot and started auto-merging it (updating full SHA1 references)