Hole in GitHub’s browser-based VSCode editor could lead to stolen token