Here are the steps:

• The attacker creates a standard Git repository.
• They commit a single symbolic link pointing to a sensitive target.
• Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
• By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands–

amazing.

deleted by creator

the problem with ORM is that some people go all in on it and ignore pure SQL completely.

In reality ORM only works well for somewhat simple queries and structures, but at some times you will have to write your own queries in SQL. But then you have some bonus complexity, that comes from 2 different things filling the same niche. It’s still worth it, but there is no free cake.

yes, just like in the OP