[intortus]

Shame on github for making these mistakes in the first place, but kudos to them for doing such a great job of engaging the white hats.

[homakov]

It's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.

[shill]

Nice work Egor. I hope to see a GitHub client testimonial on sakurity.com sometime soon.

[akerl_]

If we're shaming any code with security flaws, no one is free of shame. I'm excited by the bounty program, it's a great way to get things like this identified and responsibly disclosed

[intortus]

I agree that flaws will always exist, but I don't understand why it's ever worth it to not be absolutely strict about matching redirect_uri in OAuth.

[patcon]

Sorry, but this is a terrible approach to thinking about progressive and open security practices...