AI Agent Security (Course)
Pin Verification
Also: verify after install
Checking, after fetching code, that what you actually received matches the identifier you pinned.
In more detail
A pin to a commit hash is only a claim about what will be installed. Verification is asking the version control system for the commit you ended up with and comparing it to the pin, aborting on any difference. A 2026 Claude Code advisory showed the failure: the installer checked out a hash-shaped string without comparing the result, so a branch with the same name as the pin silently won. Checks of this kind are cheap and are what turn a pin from advice into a control.