sequoia-git versions prior to 0.6.0 contain a vulnerability in hard revocation handling due to a bug that causes the policy hash to be truncated to zero bytes. This results in only hard revocations present in the target commit being considered, ignoring previously seen revocations. An attacker with access to a compromised key can exploit this by submitting a merge request that removes a hard revocation from the signing policy. If merged, subsequent commits will not be properly authenticated against that revocation. Successful exploitation requires tricking a maintainer into merging the malicious request.