The whole sentence I wrote was: "But figuring out how they got access to a private github repo is to some extent back on github, at least potentially..."

> …That feels like a failure of logging on Github's part, without any additional information.

There you go, you answered your own question too.