When I saw some notifications today, I asked myself if somebody wanted to prove to github that a possible not paid bug bounty could be well exploited. I don't believe a spammer thinks that the github is the best way to convert his spam in $$.