This thesis measures the problem using Software Heritage, a public archive that saves projects over time. Comparing old and new copies reveals changes that the original website no longer shows. The first study finds millions of changes to version labels in about 189,000 projects; some make the same label lead to different code. The second finds millions of rewrites of published histories in more than one million projects. These include licence changes and removals of files whose names suggest passwords or private keys. The thesis also provides a novel tool for detecting such rewrites.
The third study examines archived copies of removed files. About one in eleven contains patterns resembling secrets, and many apparent private keys do not have the structure of placeholders but of real keys. This does not show whether they still provide access, but proves that deleting a secret from visible history does not make every copy disappear.
The thesis proposes that linking software to an exact, verifiable copy, rather than only to a convenient name can solve some of these concerns. Independent archives should preserve evidence of changes, and tools should warn users when trusted names or histories move. A leaked key must also be cancelled by the service that accepts it, not merely deleted from a project. Not every change is harmful, but trust must rely on evidence that survives later edits.