If Copilot was trained only on public repos like they claim, then shouldn't those API keys already be disabled due to existing secret scanning tools? For examp

If Copilot was trained only on public repos like they claim, then shouldn't those API keys already be disabled due to existing secret scanning tools? For example https://docs.github.com/en/code-security/secret-security/about-secret-scanning https://docs.github.com/en/code-security/secret-security/abo... The fact that Copilot recreates API keys that still work makes me wonder if they come from a semi-public place, because SendGrid is usually quite fast at blocking API keys that were accidentally made public.