What is interesting here though that this, like the Covid-19 leak in Brazil, the leak was on an employees GitHub. Not a companies account. So sure the employee could have prevented it, but from a company perspective. They have no authority to enforce coding practices on a personal GitHub account. The only thing I can see preventing this at an organisational level is a DLP solution scanning the repositories (GitGuardian does this for example)