Thanks for helping make GitHub Open Source Software safe for everyone.
GitHub takes the security of our software products and services seriously, including all of the open source code repositories managed through our GitHub organizations, such as Octokit.
Even though open source repositories are outside of the scope of our bug bounty program and therefore not eligible for bounty rewards, we want to make sure that your finding gets passed along to the maintainers of this project for remediation.
Since this source is part of Octokit (a GitHub organization) we ask that you follow the guidelines here to report anything that you might've found.