THIS FEATURE OF GITHUB IS AN OPERATIONAL SECURITY RISK

Summary from the TLDR Web Dev newsletter

GitHub searches and shows the entire corpus of users when adding a user to a repository.