To be honest, I wrote GitMask for myself.
Yep,if anonymity is really important to you, a VPN and/or TOR is required. GitMask just ensures that you don't unintentionally leak personal info. GitMask is open source, so if you don't trust me to run it, just run it yourself.
Spam is a potential issue. All PR's reference gitmask.com so maintainers have someone to message if they get flooded.