I shouldn't disclose how this was done until it is fixed. It seems github is unhappy with how this turned out, but I hope they fix it soon. I have already written a personal apology to Linus, and also, apologies if I have offended anyone else.

>We consider correspondence sent to security@github.com our highest priority, and work to address any issues that arise as quickly as possible.

[1]: https://help.github.com/articles/responsible-disclosure-of-s...

Of course, the question is: is there any way to prevent this in a simple way? Given anyone can push the final commit, you would need some sort of commit signing, but that sounds more pain than it's really worth.