Forking and typosquatting. If, for example, Google is famous for HIRING.md and someone squats The username Goog1e with their own nefarious HIRING.md, it seems like a great vector for phishing.

Hiring scams are increasingly common since the pandemic, as far as I can personally gather from linkedin.

I don't see the upside to it. Jobs are not 1:1 with code repositories. Jobs also don't get created/deleted in conjunction with code changes. It doesn't make sense to me to put this information in a repository when we have things like job boards already.

I think you missed the point. Instead of posting a job to dozens of job boards, a company simply updates their HIRING.md file in a code repository somewhere. For technical positions, that would be easier to search.

That just turns their hiring.md file into an additional job board to keep their jobs updated in.

It turns GitHub/GitLab/Bitbucket into search engines for jobs. That's the point.

That's much preferred than searching dozen of different job board aggregators and all the companies' websites that are not fed into such aggregators.

It just feels like this

https://xkcd.com/927/

It's not going to replace the existing job boards. It would be an addition.

Plus hiring is typically done by non-technical people. They're not going to update a markdown file in a Git repository.

Pitfalls, sure. But also many advantages! Teams looking for new ppl can include in the relevant repos, more likely to be noticed than some career page.