A Senate inquiry into a claimed repository exposure involving Nightwing shows how a single code-hosting mistake can become an oversight problem long before the technical facts are fully known.