@zekjur I think @mic92 discovered this at least two years ago and sent a private notice to the GitHub security team 🤷