There is also another scenario. I steal with social engineering (or phishing or other method) the GitHub credentials of an employee from a company I wish to ha

There is also another scenario. I steal with social engineering (or phishing or other method) the GitHub credentials of an employee from a company I wish to harm. And then I simply log in GitHub(or use a VPN to appear in Iran) with those stolen credentials. Sounds like a very easy DOS method.