[koolba]

Would it be considered spamming to pull the email address of the commits and send them an automated email?

[nitza]

Well, you don't need to send an email necessarily, a GitHub issue with a guide on how to include sensitive data in a public repo would probably suffice.

[johncolanduoni]

I suspect it would be easy to secure GitHub's cooperation in this, but almost certainly not for money or via a black box.

[rmc]

Would it be against the GitHub terms of service to do such an email?