It took me a while to find this link, as helpfully the one they emailed out is checking some referral code and currently 500'ing. I think we're probably okay a

It took me a while to find this link, as helpfully the one they emailed out is checking some referral code and currently 500'ing. I think we're probably okay as we're an open source project, do pure testing on cloud CI's, and use the separate (non-bash) modules internally. Potentially compromising the GitHub app connection does sound immediately worrying, because of GitHub's terribly lax token permissions (e.g. the "All repositories or Nothing" access) - if they saw what the app connection could see, would they be able to see all private repos? I'm somewhat sympathetic to sites that suggest curl | bash as a once-off installation. Advocating that your users curl | bash every time you test your code does sound quite a bit more irresponsible.