Comment by jedieaston

If you have public GitHub repos, people crawl them all of the time. I've seen at least three top-of-HN articles that say something like: "I scripted through 10 billion LOC on GitHub, here's a bunch of passwords", or something to that effect. Just set your repo to private if you don't want it in the vault, and if it's open source anyway, who cares?