> Git hashes are not supposed to be a security mechanism.

That you are wrong. Many people and orgs rely on this.

Does not matter if you think it's stupid, for them it is. live with it.