My money would be on somebody commiting something to an externally facing and not security certified system. You see it quite a lot things that should be in gitignore for example.