I wonder how many bugs are found this way, rather than actually looking. I found a way to extract private emails from npm a while ago, purely through chance.
If I had to guess, quite a few. I've reported my fair share of security issues and a number of them started out by accident.