At 8:49am Pacific Time this morning a GitHub user exploited a security vulnerability in the public key update form in order to add his public key to the rails organization. He was then able to push a new file to the project as a demonstration of this vulnerability.
As soon as we detected the attack we expunged the unauthorized key and suspended the user.Public Key Security Vulnerability and Mitigation · GitHub
Yes I behaved like a jerk. But why you suspended my account? Oh yea, Terms.Egor Homakov: i'm disappoint, github
But, let's get it real. It is not the way you were supposed to fix things.
Three days ago, user @homakov opened an issue on rails/rails about the prevalence of the mass-assignment vulnerability. Two days ago he responsibly disclosed a security vulnerability to us and we worked with him to fix it in a timely fashion. Today, he found and exploited the public key form update vulnerability without responsible disclosure. For this reason we temporarily suspended his account for violation of section A8 of the GitHub Terms of Service pending a full investigation into what happened. Now that we've had a chance to review his activity, and have determined that no malicious intent was present, @homakov's account has been reinstated.Responsible Disclosure Policy · GitHub