Perhaps, but realize, that the 'truly paranoid' would not use GitHub's paid offering. They'd have their own private behind the firewalls of an open source product with source code they could examine.
At least in my opinion.
At least in my opinion.
But I know people fix bugs that GitHub won't fix in their enterprise product by patching the Ruby source after each new update.