As several others have pointed out, this isn't a security issue or a bug, it's just how Git works.
However, it does make me wonder something. Do these spoofed commits count towards the "Contributions" visualization on GitHub user profile pages? I wonder if you could do this but on other people's profile pages: http://joshbranchaud.com/blog/2013/06/06/Fun-with-GitHubs-Co...
I doubt it. If you follow the links to individual usernames, you'll see that they don't even get credit for the commit that might have been made on their behalf. (Although the person who actually committed got credit for their commits.)
Comments
As several others have pointed out, this isn't a security issue or a bug, it's just how Git works.
However, it does make me wonder something. Do these spoofed commits count towards the "Contributions" visualization on GitHub user profile pages? I wonder if you could do this but on other people's profile pages: http://joshbranchaud.com/blog/2013/06/06/Fun-with-GitHubs-Co...
I doubt it. If you follow the links to individual usernames, you'll see that they don't even get credit for the commit that might have been made on their behalf. (Although the person who actually committed got credit for their commits.)