- Download all the source code and look for vulnerabilities at their leisure.

- Depending on whether they use GH for deployments they can also introduce features to production that can help them