The could be using .js and .py files directly as config files and letting the language interpreter so the heavy lifting. Just like ye olde config.php.

And yes this absolutely will allow code injection by a config admin.

Found the FF14 fan lol
The release names are hilarious

Does that still happen if you use the merge unrelated histories option? (Been a minute since I last had to use that option in git)

fail2ban isn’t a WAF?