I scanned all of GitHub's "oops commits" for leaked secrets

Git never forgets, this isn't really a shocking revelation.

Git does forget, it has a gc mechanism specifically for forgetting.

GitHub can't use the native git gc, and apparently doesn't have their own fork-aware and weird-cross-repo-merge-aware gc, so they might just not have built a way to track which commits are dangling.

But that's not obvious at all.