I'm not a git expert, but how was the attacker able to push the stability branch directly to the Amazon owned repo? The PR would have been to merge the modified branch to main right?
Is anyone familiar with the matter able to comment on the use of Torq-set fasteners? Are they a standard for these sort of use cases? They seem to be used frequently in Aerospace? I tend to use Torx whenever possible, are these better? Or should they have used something else to avoid such issues?