People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.