'How does Stripe know my secret key is leaked?

I recently moved some of my repositories from AWS Code Commit to GitHub. I accidentally made one of the repositories public, instead of private. Within less than 10 mins of committing the code, I got an email from Stripe that my secret key is publicly accessible, and it included the exact file/code line which has the key.

How did this happen?

  1. Does GitHub detects existence of some sensitive info and informs the provider via some WebHook?
  2. Does Stripe keeps crawling new repositories for such leakages? It sounds practically impossible to detect so quickly.

I cannot get my head around what could have triggered this detection at Stripe's end. I was thrilling to see the action though. Of course I have rotated the secret key.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source