Glad to see the communication between Orange and GitHub went great. Both did the right thing after discovering the flaw. Orange reported it and GitHub fixed it and allowed Orange to publish a blog post. I have to admit I'm a bit of a fanboy of HackerOne.

The custom SQL query is something that is hard to prevent. It is still hard to use ActiveRecord/Arel for everything. I'm sure GitLab is not immune to it.

GitHub chooses to encrypt their source code to prevent modifications. Our experience at GitLab is that customer modifications don't cause a lot of extra load on our support team. But of course that might be caused by having different architectures and customers.

Things have changed since then. For example, AJAX now is much simpler to use than it used to be.

    async function printExampleCom() {
        let response = await fetch("https://www.example.com/")
        // NB: Response has other methods like json.
        console.log(await response.text())
    }
    printExampleCom()

You need a polyfill for `Request` for Safari and Internet Explorer (but not Edge), but that's about it.