#disclosure

The GitHub security team responded to a critical vulnerability by closing the ticket

OrchidFiles reported a flaw that let anyone read private repo secrets. GitHub marked it duplicate, did not patch it, then banned the researcher.

Read post ↗