Don't work for GitHub, but it would not. First, it opens a Pull Request, not an automatic merge, so hopefully the code is reviewed before merge. To exploit th

Don't work for GitHub, but it would not. First, it opens a Pull Request, not an automatic merge, so hopefully the code is reviewed before merge. To exploit this, you would first need to get malicious code merged into rails master which has many eyes, and then get passed more eyes when it gets reviewed by GitHub. Not impossible, but if you got your code merged into rails master, you have wiggled your way into many more environments than just GitHub.