How can you guarantee that nobody ripped the private key before the researcher told you about the issue though?

Or has a backdoor installed somewhere?

if they can't guarantee this then every single repo that had coderabbit is potentially compromised