Should we take that as a dysphemism for &quot;code that wasn&#x27;t security-reviewed by someone who should have been Cc&#x27;d on the review&quot; instead of the much more obvious &quot;malicious commit, either from an employee or an attacker&quot;?