One scenario: If you have a build server, say running jenkins, that consumes PRs from your private github repo and automatically runs them, someone from your team has to store an API key on it. Now imagine an attacker has gotten access to the network and is able to perform DNS cache poisoning.