I once pushed a GitHub token in a public repository. They immediately revoked the token and notified me by email.