Presumably a SameSite=Lax cookie wouldn't have helped here, because > "Safe" HTTP methods include "GET", "HEAD", "OPTIONS", and "TRACE", as defined in Section

Presumably a SameSite=Lax cookie wouldn't have helped here, because > "Safe" HTTP methods include "GET", "HEAD", "OPTIONS", and "TRACE", as defined in Section 4.2.1 of [RFC7231]. But I wonder if GitHub could issue a separate SameSite=Strict cookie here as a defense in depth measure to cause the initial part of the PoC (HEAD request with credentials: include) to fail?