[Ozzie_osman]

So the original issue was described as a leak of github oauth tokens, and made it sound like the risk would be someone using oauth tokens to access github repos.

Resetting passwords implies something else may have been compromised (passwords, either hopefully encrypted), but is a pretty scary ask for them to make without providing more context here.

Trainwreck indeed.

[andreareina]

I certainly hope that passwords aren't encrypted but run through an appropriately-expensive password hash.

[Ozzie_osman]

Yes, I should have said hashed not encrypted.

[zeepzeep]

hashing is one-way encryption tho

[Tiddles-the2nd]

That's the point, take a look into salting + hashing passwords

[matthewcford]

Resetting the password resets your API key, which is different from the Oauth tokens.