web/security: fill in some commit hashes