More than 540,000 creds, valid and working, were found in public GitHub repos in a scan this July.
More than 200,000 were uploaded even after GitHub turned on a security feature to catch them from being sent to public repos
https://trufflesecurity.com/blog/github-repos-exposed-543699-credentials-nobody-revoked-them
