A git hash is cryptographically secure. It doesn't matter how you distribute it. That is the entire point you're missing.