We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.
Oddly, I don't feel that GitHub is being upfront with everything that's going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it's difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.
> he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly
If he was, he wouldn't have really made his point, would he? There are a lot of other Ruby sites which have this sort of bug.
I actually do understand suspending his account, and I even kind of get the intentionally misleading communications (you have to keep the corporate customers happy, right?), but the new "white hat" policy thing is kind of silly, because that's clearly not what this was about.
Well, you should have just stated that in the first place instead of name calling and acting immature. A simple "we have suspended his account while we carry out further investigations, this is practice" would have gone a long way to ease people's minds and kind of reactions you got. Instead, Github just came across as massive douches.
EDIT: On second thoughts, I think I am being overly critical on all parties. Instead, I think I hands up "we messed up, but we are learning" approach would be better, and we see how both sides act if/when this happens again, lessons learnt and all that!
