Wouldn't the attacker also have to have github keys, cause it's all HTTPS or SSH?