This is the most interesting question. The company is based in Canada so supposedly Canadian laws would apply but I suppose it depends on where the Gitlab instance is hosted. Also the author cannot argue that they were bug hunting in good faith as an ethical security researcher would cease activity after breaching the repository and report their findings. If American laws apply the CFAA is extremely selectively enforced but if I was the author of this I would be extremely fucking concerned about going up against the Trump entourage.