zero-day disclosure

Threats cross the line code didn't

GitHub removed a researcher after a threat statement and zero-day publication. The enforcement signal is conduct, not content. Identity is the boundary.