[basilgohar]

But then that opens them up to having their victim commit code to their repos directly, as well.

[yencabulator]

Not a big deal for an attacker to create a dummy account.