Could one not simply look at the github to verify it with their own eyes? One of git's defining features is every commit being accountable

EDIT: posted on top, see https://news.ycombinator.com/item?id=48334270

Go look for yourself, quite a few mention CVEs.