I got bitten yesterday by a PR submitted by Orbis Security that was a one line change that actually did nothing but was used to trumpet what an amazing fix it was for a blog article which was also full of inaccuracies.
The PR was useful though as it show that the supposed fix was in a function that was never called. I removed it this morning.
The PR if anyone is interested is https://github.com/ohler55/oj/pull/1011