I mean.... Github is the most common way devs get their creds leak. Sunspot happened because SolarWinds left a build system up. Security is hard.