[account42]

> the Trojan horse

I don't think that categorization is warranted - at least the linked announcement doesn't give any indication that the guy joined with the intent to cause trouble and its only after his friend got in trouble that he misused the access he had. No amount of vetting can prevent something like that entirely and only disconnected backups (thanks, git) will help you in the end.

> If anything, I think it's a bigger organizational red flag that they agreed to privately host their source code on some random git forge and not a larger, more communal one.

Did they agree to it? The linked post only says that it was offered and being discussed.

> even if they didn't want to use GitHub (did this even cost money for them)

Money is hardly the only reason why an open source project could have a problem with using GitHub.