Organizations with GitHub Advanced Security can enable the secret scanning push protection feature at both repository and organization levels via the API or with just one click from the user ...

including passwords or supposedly "secret" API keys. Even a part of an SHA-1 hash can be enough to access a "deleted" commit, as GitHub seems to be working behind the scenes to "autocomplete ...

The exposed secrets include account passwords, API keys ... Riot Games, GitHub, OpenAI, and AWS seem to have the best response mechanisms to help detect bad commits and remediate the situation.