AIUI it has been a large scale problem, just not at Github. 1. If you built or rented a botnet using people's windows boxes and read the configuration files of

AIUI it has been a large scale problem, just not at Github. 1. If you built or rented a botnet using people's windows boxes and read the configuration files of the email clients on those windows boxes, you'd find passwords for services like gmail. Google put a dent in that scheme using oauth and app passwords. 2. I know that some companies have been scanning their own computers for high-value stored secrets and asking their vendors to stop supporting such things. Such requests from GHE customers would be a real problem for Github, because of how much GHE customers pay.