Good point, only need to brute the commit being modified to have it match the original hash.<p>To get a brief sense of how hard it is to do, one can look at a sample project like gitbrute [0] that tries to brute force the first n letters of a commit hash. It took someone 30 mins to brute first 8 hex letters (of 40) on a MBP [1] with that.<p>[0] <a href="https:&#x2F;&#x2F;github.com&#x2F;bradfitz&#x2F;gitbrute" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bradfitz&#x2F;gitbrute</a><p>[1] <a href="https:&#x2F;&#x2F;github.com&#x2F;bradfitz&#x2F;deadbeef&#x2F;commit&#x2F;deadbeefa1a98280231197b184c6d7ea4d2a7055#commitcomment-8209712" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bradfitz&#x2F;deadbeef&#x2F;commit&#x2F;deadbeefa1a98280...</a>