A single git push was all it took. Wiz found the flaw. GitHub patched it in 75 minutes. But responsible disclosure tells us when a vulnerability was reported — not when it was found, or by whom.