throwaway78246··on GitHub waited 3 months to notify about potential compromiseMy guess is that GitHub ignores issues so they don't have to pay out bug bounties.
throwaway78246··on GitHub waited 3 months to notify about potential compromiseIt was also my experience that it takes GitHub several months to fix issues and inform compromised users.