I think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account.

(Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly)

What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".

A lot of the fire could have been cooled with the suspension notice being accompanied with (ideally preceded by) a personal note to Egor. The absence of that is what makes this seem more like a GoDaddy firing-from-the-hip move than a rationally thought out one.

If the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon.

There was no malicious intent from those comments - and he's done you a favour.

If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.

The hacker reported the vulnerbility responsibly but was ignored. Now you've suspended his account even though he did no harm. It looks from the outside like you suspended his account because he embarrassed you and doesn't have the public clout of someone like Zed Shaw, who also demonstrated a vulnerability (and, unlike this case, caused some downtime) yet faced no similar reprisal.

Please update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.

Can you not see that to many people, suspending Egor's account looks churlish and petty.

It's bad PR with your core demographic.

He didn't delete or break anything, yet got the issue raised and fixed near-instantly. That strikes me as responsible. Stop parroting buzzwords - nobody likes a pedant.

As someone who uses Github quite a bit: Closing his account was a shitty move.

The parent shouldn't be getting downvoted. Let's not downvote important comments in the conversation just because we disagree with them.