Git's hashes were not always verified all that often in the past (at least, as of 1.7.4.1): http://stackoverflow.com/questions/5585388/which-git-commands-perfor

Git's hashes were not always verified all that often in the past (at least, as of 1.7.4.1): http://stackoverflow.com/questions/5585388/which-git-commands-perform-integrity-checks http://stackoverflow.com/questions/5585388/which-git-command... You'll see plenty of operations do not check the sha1, and will happily hand you bad data, including checkout and clone, depending on circumstances. I haven't checked on the latest version, but at least previously, you'd have to run around using git fsck specifically to get it to notice some sha1 mismatches. So at least trivially, the idea that "it uses sha-1 so it's safe" is silly even without considering the implementation, because it doesn't always check the sha-1 :) (I'm not even going to argue it should, just pointing out it didn't) You can also GPG sign git commits (see http://mikegerwitz.com/papers/git-horror-story.html http://mikegerwitz.com/papers/git-horror-story.html for a long explanation of what does and does not get checked)