I don’t even know how they managed this. I regularly create test repos to reproduce bugs in open source software, to go with the bug report. When it contains some random generated credentials only used within that repo, Github freaks out and I need to tell it it’s just testing shit and perfectly fine to publish.

You’d have to be intentionally publicing shit like that.