This isn't a security flaw, it's just mundane crap that every web app goes through. They'll delete this today and tweak their filtering, and tomorrow the spammer will try again (or in twenty minutes, who am I kidding?).

I'm not sure why you say prior notification is proper etiquette in this circumstance. It's equivalent to pointing out a grammar mistake in a blog post. Not particularly interesting, but not malicious.

Thanks for all the downvotes, guys!

I'm not talking about "responsible disclosure" and I'm not sure why people assumed I do.

If I see that a person has their fly open, I'd go and discretely alert them of that. Similarly, if someone has a note saying "I am stupid" taped to their back (which I think is a good analogy to what the spam on github is), I would do the same.

I wouldn't go shouting "hey, github has an 'I am stupid' sign taped on their back" in town square, which is what posting it on HN amounts to.

Why? It's not like they're disclosing something sensitive, like a security vulnerability.

I don't see any reason too I'm afraid. If it was a security vunerbillity I would have, as I have done before ... https://help.github.com/articles/responsible-disclosure-of-s... (Ben Evans - @bencevans)