GitHub is not just a place where code lives. In most engineering organizations, it is part of the software delivery control plane.

That means a compromised developer machine, OAuth app, GitHub App, personal access token, SSH key, service account, CI runner, or automation script can become a supply-chain problem very quickly.

The dangerous...