The author asked me to mention that it's possible to maliciously cause a (64-bit) hash collision. In other words, you can make changes to safe file.py and evil file.py until they have the same hash. Then if you read file.py on cmt abc123 in normal git land, then run python /commits/abc123/file.py, it is possible to read the safe one and run the evil one. I think this is only a risk if you are reading from an external source but executing inside the mount, which is a weird thing to do.