I wrote "The Github Threat" about this possible issue https://carlchenet.com/the-github-threat/