Sequoia git (sq-git) versions before 0.6.0 contain a vulnerability in hard revocation handling due to a bug where policy hashes are truncated to zero bytes. This causes sq-git to only consider hard revocations present in the target commit, ignoring those in the project's signing policy. An attacker with access to a compromised key can exploit this by submitting a merge request that removes a hard revocation from the policy. If merged, subsequent commits will not be properly authenticated against the revoked key. Successful exploitation requires tricking a project maintainer into merging the malicious request.