Comment by johnwards

So, to be clear. I need to contact Github directly to see if my source has been downloaded using compromised deploy keys?