I'd say this crosses the line, in a day and age where using CURL can land jail time (e.g. AT&T "leak"). Guessing a password doesn't legally grant you the right

I'd say this crosses the line, in a day and age where using CURL can land jail time (e.g. AT&T "leak"). Guessing a password doesn't legally grant you the right to enter a server, either. That'd be like saying you had a right to trespass because someone left the gate open or didn't build it high enough. It doesn't work that way. I really think Github needs better protections for this. Consider a search for "export GITHUB_SECRET" ;-)