I actually defend Github on that front too. Let's take the long view here - Github has a growing code base and this won't be the last 0-day exploit they face. D

I actually defend Github on that front too. Let's take the long view here - Github has a growing code base and this won't be the last 0-day exploit they face. Do they really want to signal any future person that they're ok with being broken into as long as it is 'benign'? If I were Github, I would want to be telling people "Hey, work with us and you'll get your cred as a security researcher. " I reject the dichotomy that this pushes people to sell their exploits on some illegal market. I think if people wanted to do that, they would irrespective of what Github did. It took many years for the security industry to arrive at responsible disclosure guidelines; there is a reason they exist.