CLAIM-2026-09-21-09
The researchers' recommended check is to compare the commit actually in the working tree against the pinned SHA and abort on mismatch, using git rev-parse HEAD.
Why it matters
One line, and it is the only check that closes the gap independently of vendor or forge.
Sources
- airsecurity2026pluginshe