Answering the security question from the page itself, since it's more specific than the thread has gotten: their answer to secrets is "Redact before submitting — strip secrets, keys, or customer data first." It's on the seller. No anonymization or scanning step is described anywhere.
That's a harder job than it sounds, because what they're actually buying is git history. Their own proof numbers are 609M tokens of source against 13B of history 95% of the value is the commits. A key that was committed and later removed is gone from the working tree and permanent in the history. Scrubbing a checkout is a grep. Scrubbing history is a rewrite of every repo you submit, and it's the part nobody does correctly under time pressure.
Two other things worth reading closely before signing:
The hero says licences are non-exclusive. The FAQ says "You grant an exclusive licence to market and sell the codebase to buyers." Both are true and they're different exclusivities — the buyer's licence is non-exclusive, Pangea's right to broker it is not. That second one is what binds you.
And the IP line is "only code you hold the rights to," which is carrying a lot of weight given Pangea's main business is a marketplace of 150+ dev agencies. Agency work is usually work-for-hire with IP assigned to the client. For much of that network the licensable set is far smaller than "repos we've shipped," and the page leaves both the determination and the liability with the seller.
Small correction to the pricing upthread: $100/M is what the seller is paid, per the page — not what the lab pays. The spread isn't disclosed.