Really interesting experiment!
To answer "how do the bad guys find them so quickly" the answer is "judicious queries to the GitHub API."
My research group describes how this works, and what we could see with it, in this paper: https://bradreaves.net/mmr19.pdf
We're currently working on follow up work to make secret management better (with NSF funding[1]), and we're always looking for research collaborators[2].
[1] https://nsf.gov/awardsearch/showAward?AWD_ID=2055554&Histori...