fixed GitHub password vulnerability