Most of the ones I saw in github looked to be test or demo keys; not anything real. The better question are those actual non-github sites that have them expose

Most of the ones I saw in github looked to be test or demo keys; not anything real. The better question are those actual non-github sites that have them exposed (though others here have noted that those sites may already be hacked).