I'm surprised there's no software check in place that scans the code for disallowed PHP or JS functions ( base64_encode(), etc ) when pushing up to the Repo... That would've thrown a red flag immediately.