I agree with Sarah. No way, no how should anyone be processing customer credit cards with code that doesn't have a way of applying security updates.

If they want to release it first on github, it should be locked down to only work with testing or sandbox environments, not actually merchant processing accounts.