Security Incident Disclosure (arbitrary code injection and auto-merge) | Hacker News Reader