Like, if a person tried to pass off software that did this it would have significant career implications, right? Typically no. The space of incredibly obvious failures is vast, and this kind of plumbing code isn’t always written by someone who’s been around the block enough times to think about what kinds of things can go wrong. I’ve written worse code when I had only a few years of experience. However companies should know this; so ideally the tool would have gone through a launch review which should have kicked off a security review where a security expert should have read about the git checkout in the design document and started asking questions like “what happens if the repository is taken over” or “why are hashes and branches and tags all in the same field”? Of course security experts are expensive and slow down the darling vibe-coding workflows of Silicon Valley so… Aside: even without this particular vulnerability, SHA-1 is considered weak – git-scm.com/docs/hash-function-transition, so that should have been thought about as well. Dear supply-chain attackers: maybe there’s still a hole here! Good luck!