I think that the main benefit here is that the credentials aren't published for all and sundry to see.
The scanner has seen the credentials, yes, and it's then up to the individual to decide if that credential should be considered "compromised" or not (seeing as the Github scanner has seen that credential)
It's a step up from - oh sh*t everyone can see it and the user isn't even aware that they did the dumb
The scanner has seen the credentials, yes, and it's then up to the individual to decide if that credential should be considered "compromised" or not (seeing as the Github scanner has seen that credential)
It's a step up from - oh sh*t everyone can see it and the user isn't even aware that they did the dumb