The commit message is part of the hash. You could have quite a lot of entropy there which wouldn’t get much notice until the postmortem.