The problem is already well described over here

https://bugzilla.redhat.com/show_bug.cgi?id=1043311

but perhaps here in the KDE forum it is more readily percieved:

--
When pushing files to github with git, ksshaskpass is brought up by default to ask for username and password. It does this with two successive dialogs. One for to obtain the git repo username, and another to obtain the git repo password.

When it asks for username, (the fist dialog) the dialog text doesn't clearly indicate it is asking for github username, but rather a password. User can mistakenly enter password, which then may be sent over over public DNS request as a path component to the repository.
--

Also, what is the the point of kwallet if it does not store the credentials?