Reporting it to github wouldn't have demonstrated the problem he was trying to flag. His problem wasn't "gitub is insecure" but instead "rails by default is ins

Reporting it to github wouldn't have demonstrated the problem he was trying to flag. His problem wasn't "gitub is insecure" but instead "rails by default is insecure." When told by the rails team that fixing this problem was the responsibility of rails users, he demonstrated that even the most sophisticated users (presumably, github devs) were exposed. If he had submitted a bug report to github, they would have probably just fixed it. And the problem he was flagging in rails wouldn't have been any closer to fixed.