It's hard to shame github for those bugs. All of them are low-sev separately, only together they make sense.
Nice work Egor. I hope to see a GitHub client testimonial on sakurity.com sometime soon.
If we're shaming any code with security flaws, no one is free of shame. I'm excited by the bounty program, it's a great way to get things like this identified and responsibly disclosed
I agree that flaws will always exist, but I don't understand why it's ever worth it to not be absolutely strict about matching redirect_uri in OAuth.
Sorry, but this is a terrible approach to thinking about progressive and open security practices...