Why Your Git History Isn't Enough as Proof

Short summary

Git history is not reliable proof of code authorship or priority because commit dates can be rewritten, force-push erases history, and anyone with write access can alter shared history. GPG-signed commits prove identity but not timing. For genuine proof, you need an independent third-party timestamp (RFC 3161 TSA) anchored to an external immutable source of truth. The article recommends this as basic hygiene for startups with co-founders, freelancers, and teams protecting trade secrets.

• •Git commit dates and authorship are trivially rewritable — git is not a proof-of-time system
• •GPG signatures prove who signed but not when the content was created
• •Use RFC 3161 Time-Stamping Authority for independent, unfalsifiable proof of priority

Generated with AI, which can make mistakes.