Well, take a shotgun approach, insert vulnerabilities in multiple repos. Or obfuscate the attempt - insert a small vulnerability in one of the libraries that ra

Well, take a shotgun approach, insert vulnerabilities in multiple repos. Or obfuscate the attempt - insert a small vulnerability in one of the libraries that rails uses (let's take a mailer lib) and that only gets triggered when certain obscure preconditions are met and then push a commit on top of rails that creates the required preconditions. Instant exploit - and each commit by itself may very well look innocent. Or spread the exploit over multiple commits, each one innocent enough, each one with a different user. Be creative, you'll find a way. And even if it's caught, then the risk fingers pointing at you will be minimal.