Any credentials that are pushed to GitHub are as good as immediately compromised.