[Znafon]

It's actually GitHub that contacts AWS even before the commit finishes being sent to GitHub so it is indeed very fast.

[paultopia]

Really? If Github is already detecting credentials that reliably, I wonder why they don't just switch repositories to temporarily private and e-mail the account owner themselves...?

[netzvieh]

Because the key has to be revoked on AWS side, not just removed from the repo. And probably the person pushing to Github and the person paying the AWS bill/the AWS admin are usually not the same..

[Znafon]

I don't think they do detection reliably, they have no idea whether it is an actual key or it could be a placeholder used as documentation for example. I don't know the details bit perhaps they just send it to AWS and AWS doesn't tell them whether it is an actual key or not?

[thunderrabbit]

Or at least display a confirmation box..