Hacker News Reader

They do, this was likely in a private repo which isn’t scanned.

I pretty sure had a PEM cert in a private repo and was alerted. Is this in their TOS somewhere?

You can opt into secret scanning on private repos, but it isn’t default when I last used it.