Comment by guitarbill

Amazing, they've used prepared statements wrong every time: https://github.com/gitpay/website/blob/master/functions.php

Sadly, SQL injection vulnerabilities aren't a rarity for PHP sites :( It's too easy to make this exact mistake.