531
Developer posts secret key on GitHub, loses $40K in 2 minutes
(cointelegraph.com)
This is a most excellent place for technology news and articles.
They notify but iirc only if you push a commit to a public repo. The dev in the article pushed it to a private repo, then later made the repo public.
The docs say they can reject if you enable push protection, which is also available for private repos, just as a paid feature. It's free for public, but still needs to be enabled.