[vulf]

You could just use the SMS option instead of the app one when you turn on github's 2fa. Then no 3rd party will have access to the secret.

[wereHamster]

Except the NSA party...