rails/rails — comment on commit b83965785db1eec019edf1fc272b1aa393e6dc57
File:  line 0
By DouweM:

@Tie-fighter I'm not so much concerned over violating the ToS, I'm concerned over all the innocent people that got hurt, albeit ever so slightly :p I think he should just have created a second account and tested everything that way. I'm sure they would've forgiven him for creating a second account had he just reported his findings afterward.

@MeachisM Ah you're right, he did show 2 days ago that he had found at least one vulnerability. There's no indication he told GitHub about it though, he was trying to get the attention of the Rails core team to change the default for mass-assignment attribute protection, which I definitely agree with.