> And just because a key is public, doesn't mean that it is going to be automatically sent to a third-party. In practice, it pretty much does - bad actors cont

> And just because a key is public, doesn't mean that it is going to be automatically sent to a third-party. In practice, it pretty much does - bad actors continuously scrape the GitHub firehose looking for AWS secrets, and then automatically spin up EC2 instances to mine cryptocurrency. GitHub's token scanning just ensures that AWS sees the tokens too. If you don't believe me, keep this website open for a few hours - it's a realtime stream of secrets scraped from GitHub: https://shhgit.darkport.co.uk/ https://shhgit.darkport.co.uk/