> He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Assuming no economic impact to github you mean. If pay

> He made an attempt to patch upstream, was shot down, and then proved his point without hurting anyone. Assuming no economic impact to github you mean. If paying users leave because they feel github is no longer safe for private repos because of this, that is harm. I imagine a bank would be far more grouchy if someone exploited a vulnerability and deposited one cent into someone's account "just to show there was a vulnerability" then publicized it, without talking to them about it first. <sarcasm>No harm done right?</sarcasm> Now, I am not saying that it is bad that this github vulnerability was found and fixed. I am very glad! But I think it could have been far more responsibly done.