I think they should be on a separate page, or some other system but if they’re on GitHub attackers could just tell people to download it from GitHub.

I understand what you’re saying as in this case it’s a major security bug but in other cases, it might be needed.