https://www.coderabbit.ai/blog/our-response-to-the-january-2...

> No customer data was accessed

As far as I can tell this is a lie.

The real answer is that they have absolutely no clue if customer data was accessed, and no way to tell. I'm not even sure Github could tell, but it's not clear if the exploits way of generating private keys to access private repositories is any different to what CodeRabbit does in normal operation.