I fully agree, but isn't that roughly the same with Github?

Technically it's much much different of course, but if you commit some private keys/etc to Github, you have to invalidate everything used and assume that someone saw it, Google saw it, and it's cached in multiple places. Right?