Two months after Rapid7 discovered the hole in the Git service, the project maintainer has yet to patch the bug.