I'm not surprised. Even great devs sometimes slip up and when you have enough people, someone is always slipping up. The only real solution IMO is to have safeguards in place like credential scanning (ideally both locally and on the server). It's not foolproof, but it can help avoid or minimize a lot of incidents.