[going_north]

This seems like a non-story to me. Once you post a code repo on the public internet, and especially on a site as prolific as GitHub, you should treat everything in there as public information.

> Dror said that Lasso reached out to all affected companies who were “severely affected” by the data exposure and advised them to rotate or revoke any compromised keys.

If the "companies affected" have any idea what they are doing all of the exposed tokens and the like would have been rotated a long time ago.