i.e.:

array(7) { [0]=> array(7) { ["file"]=> string(50) "/home/i...../src/App/Tracker/Model/IssueModel.php" ["line"]=> int(445) ["function"]=> string(8) "getState" ["class"]=> string(43) "JTracker\Model\AbstractTrackerDatabaseModel" ["object"]=> object(App\Tracker\Model\IssueModel)#313 (7) { ["context":protected]=> string(17) "com_tracker.issue" ["name":protected]=> string(5) "Issue" ["option":protected]=> string(7) "Tracker" ["table":protected]=> NULL ["project":"JTracker\Model\AbstractTrackerDatabaseModel":private]=> object(App\Projects\TrackerProject)#350 (13) { ["project_id":protected]=> int(1) ["title":protected]=> string(11) "Joomla! CMS" ["alias":protected]=> string(10) "joomla-..." ["gh_user":protected]=> string(6) "j....." ["gh_project":protected]=> string(10) "j.." ["gh_editbot_user":protected]=> string(14) "joomla..." ["gh_editbot_pass":protected]=> string(40) "b

ok but you should open this issue on the correct repo https://github.com/joomla/jissues/issues

please open an issue on that repo https://github.com/joomla/jissues/issues

ok, i now did, just for the reference - joomla/jissues#1133

You should never have posted this on the tracker - just like the issue template you selected told you, it should have been emailed direct to Joomla! Security Strike Team security@joomla.org

my apologies for not evaluating this correctly, i didn't really expect this to be that serious.
kind regards, stan

Exposing the Github Credentials for any app that has read and write access... yeah I would say that was serious.