Research tied to signed commits suggests that a trusted-looking hash can change while GitHub still shows “Verified,” forcing teams to rethink what their review process really proves.
A security disclosure around GitHub commit verification shows why a trusted badge can still hide a tricky identity problem for supply-chain tooling.