imtsubaki

I was inbetween customers IRL, so I apologize my answer was not the greatest and was a bit quick, MKMoose's reply right after hit's the nail on the head for what I was trying to cover.

Well there isn't really a public source I can cite for individual repo permissions and what not, you can see on the Discord channel 'rules-and-info' what his title is. But most of what else I said comes from looking through the repo myself and talking with other developers over time. I am actively contributing to the game as well, so I do have some direct context here.

Maltiez was brought onto the team primarily as a Mod API programmer. A very large portion of his work has been bug fixes and changes to the API, either extending what mods are able to do or making certain things easier to accomplish without having to work around the existing API. Because most of that work is in the API, the actual source involved is also publicly available through Anego Studios' GitHub. This isn't code that only exists inside some private build where nobody outside the dev team can see what is actually being shipped. He also isn't overseeing or directing some large part of the combat update. Given his experience with his previous combat overhaul mod, it shouldn't be surprising that he has helped with parts of it or offered input where relevant, but much of his earlier work was focused more around bug fixing and changes or additions involving entities, animal AI, and the modding API in general. I don't really want to get into internal development specifics beyond what is already publicly visible, but I do think there is a fairly distorted picture forming of what his role on the team actually was

While it's completely understandable for people to be suspicious after someone has violated the community's trust, I think some of the concern around Maltiez' contributions to the game itself is getting a bit detached from how development actually works. Maltiez did not have direct push access to the game's master branch. His contributions went through merge requests and review like other developers, so he could not simply slip something into the game independently or replace a compiled binary with something different from the reviewed source. Most of his work has also been around the modding API. That code is directly forked and published on GitHub, meaning the same source being used by the game is publicly available for anyone to inspect. There isn't really an equivalent here to hiding functionality inside a third-party DLL distributed with a mod. I'm sure his previous MRs will be looked over again given the circumstances, and I think that is a perfectly reasonable precaution. But there is a pretty large difference between reviewing his past work to be safe and assuming the game itself may have been compromised. Based on how those contributions are submitted, reviewed, and distributed, there isn't much reason to believe there is anything malicious hiding in them. Unlike what is possible on the ModDB where the mod author is directly responsible for uploading the binaries.