Comment by LoganDark

> it also requires that you know the commit IDs, which is not something you can get via brute forcing the API

Well, GitHub accepts abbreviations down to as short as four hex digits... as long as there's no collision with another commit, that's certainly feasible. Even if there is collision, once you have the first four characters you can just do a breadth-first search