I don't get how that output showcases anything, unless he had run that against a known instance of forgejo so the owners of that instance could confirm that he actually executed code. But he's only showing a text file, that's like saying look I hacked super_secure_self_hosted_service:

python hack_it.py localhost:3000

Hacked!

For all we know chain_alpha.py is just a bunch of prints.

Also, even if it is real (which I don't really doubt, but I have seen no proof) holding the information instead of properly disclosing it is just childish. It's not a carrot methodology, it's a stick one, and one without a carrot. This is the sort of thing you do to big companies with no morals, doing it to a small open source project is just wrong, they don't have the manpower or money to redo the investigation you already did. Release a CVE, talk to the devs, and/or push a PR, but saying "I found a vulnerability but I won't tell you about it" is just dumb.