Your Signed Git Commits Are a Lie. Here’s the Truth.
Most developers assume signed Git commits are tamper-proof, but the underlying hash is malleable. Attackers can exploit properties like ECDSA nonce reuse to alter commit content while preserving the signature. This vulnerability turns a trusted security feature into a dangerous false sense of safety, undermining the integrity of your entire code audit trail.