> So if you happen to be able to make ␛]8;;https://example.com/"/...␇ appear in the job logs —4 which you can, either without even having an account, by sending a patch to a public mailing list with continuous integration turned on

The fact that this could be triggered so easily — just sending a malicious patch to a mailing list — is pretty insane.