I get automated emails that I didn't sign up for from GitGuardian: "GitGuardian has detected the following Google Key exposed within your GitHub account." My

I get automated emails that I didn't sign up for from GitGuardian: "GitGuardian has detected the following Google Key exposed within your GitHub account." My understanding was that they could use an API to check whether it was a real key, but perhaps that doesn't say whether it is a client-side or server-side key?