Maybe they search the tokens public key and not the token itself. Then if the public key is found, then they download the repo and do scanning for the private key.