Comment by marysol5

They've been doing that for a long while.

Publish something to Github in a public repo? It pulls it, scans it, and reports!

Especially if you accidentally put in keys