A Stranger's Pull Request Almost Stole My Cloud Credentials