A vulnerability in VS Code's issue management function and a lack of authentication checks enabled the researcher to obtain push access, and write to the repository.

"With push protection, GitHub will check for high-confidence secrets as developers push code and block the push if a secret is identified," GitHub said.