It's certainly possible, but very very unlikely. I think Scott Chacon, author of Pro Git, has great quote relating to the collision probability for SHA-1: "If all 6.5 billion humans on Earth were programming, and every second, each one was producing code that was the equivalent of the entire Linux kernel history (3.6 million Git objects) and pushing it into one enormous Git repository, it would take roughly 2 years until that repository contained enough objects to have a 50% probability of a single SHA-1 object collision. A higher probability exists that every member of your programming team will be attacked and killed by wolves in unrelated incidents on the same night." Git LFS actually uses SHA-256, which is more secure than SHA-1, though I believe no less likely to accidentally collide. Regardless, collision is interesting to think about, but can be disregarded in practice.