GitHub flaw could put millions of users at risk