A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed hashes out there in the public Git repositories of the web, along with details on how to reproduce them.

Is there some known attack on some protocol where this might be leveraged? Something like “well, I can do something evil if I replace this unknown plain text with some other plain text with the same SHA-1 hash, so instead of computing a collision I'll google for it.” Of course, the space of all hashes is still far from covered by Git commits, but nevertheless, I'd guess all the Git commits out there might amount to quite some CPU hours of computing SHA-1 hashes. I'm not sure whether that guess is justified, though.

As far as I can see, such an attack would only work if the hash is visible, the plain text from which it was generated is not, but some cypher text generated from is, and a different text can be encrypted as well. So this looks like it might apply to some public key based protocols, where you can encrypt but not decrypt. Furthermore, you don't have control over the colliding plain text, so obvious things like putting your own name as the beneficiary of some financial transaction won't work. Are there any scenarios where such a crowd-sourced hash collision could cause serious trouble with non-negligible probability?

Is Git crowdsourcing the production of SHA-1 preimages?  Not to any meaningful degree.

Github doesn't say how many commits it's tracking, but it's probably not more than a few billion.  For comparison, there are 1,461,501,637,330,902,918,203,684,832,716,283,019,655,932,542,976 possible SHA-1 hashes, so the odds of finding a plaintext matching an arbitrary hash of interest are effectively non-existent.
