Thanks to @cvennevik and @aardrian for pointing out this amazing story.
My opinion: curious coders experimented in good faith, discovered a serious architecture issue with technology and policies, tried to notify and rectify, but got blamed by commercial entities instead of being thanked for their good faith disclosure.
It's very much worth the read:
https://boehs.org/node/npm-everything
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.