01
Yes, GitHub's green "Verified" badge can be spoofed
The badge certifies that a cryptographic signature is valid and linked to an account — not that the named person actually wrote or reviewed the code, nor that the commit chain behind it hasn't been recomposed at some point.
02
The real vector: the badge doesn't distinguish who reviewed the code
Merges done through GitHub's web interface are signed by the "web-flow" bot, not by the original authors of the commits they contain. A green badge on a merge commit doesn't guarantee every individual commit was signed by whoever claims to have written it.
At Blurtek we audit your repository and CI/CD's actual configuration, not GitHub's marketing checklist.
Request an assessment