I think the most striking thing is that for outsiders (i.e. non repo members) the acceptance rates for gendered are lower by a large and significant amount compared to non-gendered, regardless of the gender on Google+.

The definition of gendered basically means including the name or photo. In other words, putting your name and/or photo as your GitHub username is significantly correlated with decreased chances of a PR being merged as an outsider.

I suspect this definition of gendered also correlates heavily with other forms of discrimination. For example, name or photo likely also reveals ethnicity or skin colour in many cases. So an alternative hypothesis is that there is racism at play in deciding which PRs people, on average, accept. This would be a significant confounding factor with gender if the gender split of Open Source contributors is different by skin colour or ethnicity (which is plausible if there are different gender roles in different nations, and obviously different percentages of skin colour / ethnicity in different nations).

To really prove this is a gender effect they could do an experiment: assign participants to submit PRs either as a gendered or non-gendered profile, and measure the results. If that is too hard, an alternative for future research might be to at least try harder to compensate for confounding effects.

I think (unless I misunderstood the paper), they only included people who had a Google+ profile with a gender specified in the study at all (this is from 2016 when Google were still trying to make Google+ a thing).

People contributed to HashiCorp products - the software is not something solely made by HashiCorp. This might technically be legal under their CLA and indeed even in the absence of the CLA, under the Apache License, but it certainly isn’t fair to people who contributed to it voluntarily in the expectation it would form part of a Free software project.

I think maybe the best way to combat this type of thing in the future is if F/L/OSS communities (i.e. everyone who contributes to a project without being paid) starts: 1) preferencing copyleft projects over BSD/MIT type licenses, and 2) refusing to sign any kind of CLA (maybe with an exception for obligate non-profit organisations). Then, companies will either have to pick developing entirely at their own cost, or to accept contributions on the incoming=outgoing model, meaning they are also bound by the copyleft licence and are forced to keep it as Free software. That would end the bait-and-switch of getting people to work on your product for free and then saying “surprise suckers, it’s no longer Free software!”.