They are lucky this wasn't much, much worse.
Why does the error reporting service need to call the web thread back anyway?
Yet another case where immutable-everything would have prevented this hairball from accreting in the first place.
An IDOR is embarrassing - this was a complex bug and Github's investigation/response was great here. I'd be proud if my company handled a security incident like this.
The follow-up report is good, but it doesn't matter when the conclusion is "our footguns backfired".
And Unicorn is pretty old. It wouldn't surprise me if this object reuse dates back to mongrel's code base, back when doing anything with threads in Ruby would have been unusual.
It's still bad code on unicorn's part (when I got to that part of the post I said "Unicorn does WHAT?" out loud), and GH should have been more careful introducing threads to an environment that didn't have concurrency before, but every step of the chain is pretty understandable IMHO.
Probably it wasn't that obvious in the code to see.
But if they would've used immutable objects, or at least pure functions with scalar parameters in the first place, such an error would never occur.