Any automated detection scheme can be thwarted by encryption as trivial as ROT13. You could leave a comment in README: "To decrypt, just run 'l33t-xor-crypt --

Any automated detection scheme can be thwarted by encryption as trivial as ROT13. You could leave a comment in README: "To decrypt, just run 'l33t-xor-crypt --key bob --file hacked-data.txt'" and Github's scanner is none the wiser. Meanwhile, it will be finding all the false positives already mentioned, especially test suites with fake data.