There’s a follow up by the author:

https://dustri.org/b/follow-up-to-carrot-disclosure-forgejo.html

Including this:

So I ended up sending and email to Forgejo security team, containing: an apology, a bit about my reasoning for proceeding with carrot disclosure, recommendations about what to harden/review, and a bunch of commented exploits/proof-of-concepts as attachment. We’ll see how it goes.