Ha! Yeah. I must admit I've accidentally committed a Github access token before. It was in a `secrets.sh` file which I mistakenly thought was in `.gitignore` and carelessly added to a WIP commit.

Github was amazing, they detected it, saw that it was valid, and revoked the token. Big love.

On private repos: it would be a sad, sad thing if all those half-baked pet projects went away, there's an awful lot of valuable random stuff in public repos.

Also PSA: if you ever decide to make said repo public, `git push --force` does not make the old commits unaccessible; doing so is not a secure way to remove secrets from a git remote before making it public