Yep, and its a really small world out there.

If researchers stop believing MS will treat them fairly it's bad news for the entire security industry.

Not to mention all the startups being founded right now. Sure, github's still the default, and maybe you can still monetize stars or something, but it's also a clown show from an availability, feature roadmap and company policy perspective.

Is it really fiscally responsible to tie your company's future to that?

I wonder if anyone tracks metrics for this stuff. Percentage of stuff with a repo there is probably still high, but what's happening with stuff like github actions, and are devs directly pushing to github, or are they just mirroring an internal / other provider's git repo to it?