This seems like a very inflated article title. It can only find Deleted or Private commits on repos you have access to, which is a much different claim then the title initially read to me.

You can likely do this without the GitHub API, with just the git protocol itself.

Just ask for the commits and see what the server says.