An immutable reference is a fixed identifier that always points to the same source content, such as a Git commit SHA, an image digest, or a signed release hash. Unlike a branch name or moving tag, it cannot be retargeted later, so it gives teams a stable way to say exactly what was built, scanned, or deployed.
In cyber security, immutable references matter because they reduce supply chain ambiguity. Defenders can pin dependencies to a known commit, verify artifacts against expected digests, and reproduce builds with less risk of silently receiving altered code. Attackers often exploit the opposite problem: mutable references that can be swapped, overwritten, or poisoned in a package registry, CI/CD job, or release channel. Using immutable references does not stop compromise by itself, but it makes tampering easier to detect and rollback decisions more reliable.