SHA pinning means locking a dependency, plugin, or package to one exact commit hash in a source repository. The SHA identifies a single revision, so the build or installer should fetch and verify that specific code rather than a moving target such as a branch name or tag. This matters because tags and branches can be retargeted later, while a commit hash is immutable.
In cyber security, SHA pinning is a supply chain defense. It helps ensure that reviewed code is the code actually installed, reducing the risk of repointed dependencies, malicious updates, or unexpected changes in an agent’s plugin pipeline. Defenders use it for dependency management, plugin installation, and automated builds, often alongside signature checks and strict update policies. If a tool ignores the pinned SHA or silently substitutes another revision, the protection fails and an attacker may gain a path to run untrusted code inside a trusted workspace.