Note also: The github event feed appears to be public, so people have often had bots listen automatically for keys for exploitation. I recall reading (earlier this year?) about how someone had some $Ludicrous AWS bills because of this.