Gitloker attacks abuse GitHub notifications to push malicious OAuth apps

New York Times source code stolen using exposed GitHub token

Content Injection Attack on GitHub

Developer posts secret key on GitHub, loses $40K in 2 minutes