diff --git a/appview/repo/compare.go b/appview/repo/compare.go
index 9f8bf4f5..0446e779 100644
--- a/appview/repo/compare.go
+++ b/appview/repo/compare.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 
 	"tangled.org/core/api/tangled"
@@ -17,6 +18,8 @@ import (
 	"github.com/go-chi/chi/v5"
 )
 
+var shaPattern = regexp.MustCompile(`^[0-9a-f]{4,40}$`)
+
 func (rp *Repo) CompareNew(w http.ResponseWriter, r *http.Request) {
 	l := rp.logger.With("handler", "RepoCompareNew")
 
@@ -132,6 +135,11 @@ func (rp *Repo) Compare(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if shaPattern.MatchString(base) || shaPattern.MatchString(head) {
+		http.Error(w, "comparing by commit SHA is not allowed, use a branch or tag name", http.StatusForbidden)
+		return
+	}
+
 	scheme := "http"
 	if !rp.config.Core.Dev {
 		scheme = "https"