They have marked the repo as noindex (or GitHub is forcing a noindex header).
Its returning a noindex flag so every serp is correctly doing what the repo has been asked.
That is... except for brave! I checked on my searx instance and it still showed up in brave's results
Very interesting. The security page does show up on kagi at #6.
I wonder if GitHub flags it to not be indexed or something.
They even find a fork of that particular repo, which in turn links back to it, but refuse to show the result I want. Have't found any DMCA notices. What is going on?