> If someone uploads their AWS token to Github it isn't legal to use it even if it was made public. I'm pretty sure these kinds of services where you can incur

> If someone uploads their AWS token to Github it isn't legal to use it even if it was made public. I'm pretty sure these kinds of services where you can incur significant charges by using the API have a stipulation in their ToS that any API calls performed with your key are considered to be made on your behalf. Kinda like banks do with online banking, "everything done online under your login is considered as if you've done it at a branch with paper forms". Regardless of laws it's still your own responsibility to protect your credentials.