Just as an FYI, those will likely live in Github forever. Run `git ls-remote` where ever you have had this problem. You'll see that there are refs for every PR in the form `refs/pull/NNNN/head` and `refs/pull/NNNN/merge`; where `NNNN` is the PR number, `head` is the latest commit and `merge` is the final commit.
If any of those commits with confidential information is reachable from any of those commits, then they'll never be garbage collected from Github.
If any of those commits with confidential information is reachable from any of those commits, then they'll never be garbage collected from Github.