I would assume the lawyers have to get involved first to write up some document proving that github is not liable for what users do with their app tokens. CYA, then tell the public