Agree, this is a rather trivial use case. Let me know if you have any specific PR that you'd like me to test this on, or feel free to test it yourself https://github.com/presubmit/ai-reviewer
This was actually a true impersonation case, because researcher's twitter username was free on github so attacker just created a new account with that username and used it to create the malicious PR.
I build a platform where UK students can trade stuff with our peers without any charge in a safe, quick and convenient way. All users are verified through UK university email (.ac.uk.) and you can filter products by university so you can trade only with people around you. Any UK student can register and sell a product for free. If your university is not on the website, message me and I will add it. Let me know what you think. Thanks.