Maybe I missed something, but from looking through his posts, it seems that Egor felt the defaults in Rails were insecure (let's face it, they are), and then wh

Maybe I missed something, but from looking through his posts, it seems that Egor felt the defaults in Rails were insecure (let's face it, they are), and then when he didn't get the immediate feedback from the rails team that he had hoped for, he decided to illustrate his point by hacking Github, which happens to be built on Rails. Nowhere did I read, on his own blog or within any of the rails issue tickets, that he actually tried reaching out to Github (i.e. contacting security@github.com) before exploiting the vulnerability. Maybe he did try to contact Github first, but I didn't see anything mentioning that in any of the linked posts.