A company I worked for a few years ago sold a source code license and I was tasked with sharing the source, sans history and only at a specific point in time, to the purchaser’s GitHub organization . I was told it had to be done as quickly as possible, and that we might do it a few more times so figure out a way to make it repeatable.

I wrote a Bash script to copy our ~25 repositories to a new organization using the GitHub REST API. Turns out that the default when creating a new repository was to make it public. Within a few minutes I was getting emails by third party services who had downloaded and parsed our code, discovering a long abandoned AWS credential hard-coded in an older codebase. (I think GitHub now does this for you)

I was lucky that nothing important was actually compromised (we had done a decent job of keeping secrets out of our repos and the one exception was an account that was long gone), but it was an eye-opening experience. If these services had found and downloaded our code in minutes you can assume any repo made public, even for a few moments, has been downloaded and cataloged by a potential bad actor.