[pyre]

It's also possible that they just scrape the Github firehose for common patterns like

  AWS_SECRET_KEY="FOOBAR"

and send a message to the committer's email (since you presumably used a correct/valid email in the git commit).