Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things.
Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve” their flow to account for wrong user input.
Because user input can be wrong in both email or password, the error message should account for both.
Obviously, Github and Stripe aren't actually enforcing these messages as part of some larger security policy, or if they are, they're doing it very poorly. But if they were, the email shuffle is what they ought to be doing.
My short gmail address gets a signup on some random website a couple times a month and they're often nigh unto impossible to delete.
Fitbit is one of the worst for this.
Might as well let a user logging in that the username is incorrect to make the legit use case, i.e. user has a typo and/or misremembers their username, more pleasant.
I usually suggest clearing the username field on failed logins as well. That way if there is a typo, the user doesn't try it again thinking only the password is wrong.
Default to knowing your threat model. Default to balancing security concerns with UX, and make an informed decision instead of blindly following best practices.
That’s an easy way to be targeted.
First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities.
If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site.
If exposing who's registered on your site really is a threat, then by all means have a weird registration (and password reminder) that doesn't tell whether it worked or not. But if your site is for cookie receipies and you don't consider exposing who's a fan of cookies a privacy violation, then just use most helpful messages you can.