Every year the tooling improves: pre-commit hooks, platform secret scanning, cloud provider alerts that fire when a key appears in a public repo. Every year someone still pastes a live token into a README “just for the demo” and goes to lunch.
The pattern is almost affectionate in how predictable it is. A contractor clones the wrong branch. A student project goes public. A CI variable gets echoed into logs. By Saturday night the on-call phone is buzzing because a crawler found the key before the humans did.
- Rotate first, investigate second, when a secret might be public.
- Block pushes that match known key shapes — do not only alert after the fact.
- Give contractors short-lived credentials with boring expiry dates.
- Practice the revoke drill so it is not improvisation at 1 a.m.
Culture that treats leaked keys as a process failure — not a personal shame spiral — cleans up faster. Shame makes people hide. Process makes people revoke.
Seen up close, the pattern is less about breakthrough theatre and more about quieter competence: fewer surprises, clearer owners, and tools that survive contact with Tuesday afternoon.
Public GitHub is only the loudest case. Internal mirrors and forked templates leak just as cheerfully — they just page a smaller audience.