That's not really how thinking about security works. "But everybody else is doing it" wasn't a valid argument in school, still isn't. As a thought experiment,

That's not really how thinking about security works. "But everybody else is doing it" wasn't a valid argument in school, still isn't. As a thought experiment, (ignoring the fact that it's not an appropriate store for such things, and only thinking about security towards third parties) how would you feel about a company storing your PII/medical records/credit card number in a private repo on GitHub? That's how your boss thinks about the company's intellectual property.