Given that a malicious party gains access to a GitHub repository, would it be possible for the adversary to delete or modify versioning information / history after she altered code stored on the repo? Is it possible to always detect such code changes after a compromise of a GitHub repo?

1 Answer 1


The most damaging thing someone can do to a GitHub repository is to delete it. With enough access they could then create a new repository with the same name. After that, anything they wanted can be different from before.

Git lets you sign commits. Making and verifying those digital signatures is a good way to assure yourself that the changes retain integrity.

  • 1
    Git currently uses SHA-1, which is vulnerable to collision attacks. A sophisticated attacker could create a benign commit with the same fingerprint as a malicious change.
    – forest
    May 22, 2018 at 4:42
  • Would you consider it rather realistic or unrealistic that an adversary with access to a GitHub repo, with commits that were not signed, is able to modify the commit history and hence is able to attack the integrity of the stored data without being noticed? May 22, 2018 at 10:20
  • The tricky part to answer is “without being noticed”. I can certainly contrive a scenario with an undetected attack. Git makes it easy to spot when someone has altered the history of a repository underneath the work you're doing. On the other hand, Git also provides all the tools you'd want to completely change the history of that repo. May 23, 2018 at 8:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .