SQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Masto

SQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Mastodon uses. Specifically, this was the commit (from a mirror of the repository): https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1580719a3a1bfb715f6d8 https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1...