Based on his comments in the various issues, it seems to me that GitHub was only the "target" because it happened to be where Rails master was hosted (and, of course, demonstrated the vulnerability). It seems like if Rails had self-hosted, Homakov would have demonstrated the problem there instead.