Hello,

I was recently really stumped when seconds after I pushed my latest commits to github, I got an email from openai saying my API key has been leaked, I assume they are just scanning repos for keys but that doesn't sound feasible since, how many repos will they have to keep track of and most of which will be private and I don't see how they might get access to those repos, which was my case.

They can also be detecting it with the openai cli tool, this seems to be the most likely no that I think of it.

so what do you think, if you know how they do it please enlighten me.

regards.

Edit

some of your suggestions were right, My repo was indeed public. I suppose it was detected because of this. I however haven't tried replicating this with the repo set to private. But as most of you suggested, It probably wont be scanned since it's a private repo and there might be some privacy concerns in those cases.

But anyhow, thank you all for you VERY insightful comments.