> The problem? It had access to gh issue create via my GitHub credentials, and no guardrails preventing it from using them.
The problem surely is you gave it your credentials without considering the consequences.
For sure! Just ask enough times "why" and you will find the root. The main issue here it is, how many people do that for real, and how this is becoming even more critical now.
> Just ask enough times "why" and you will find the root.
Once was enough. The root is lack of concern for security, and for GH terms of use.