I know blackhats and grayhats must have been doing it for years. But I'm not aware there's any bot that acts in a whitehat manner to disclose it to affected parties and conduct public researches, is there? I mean, something like those RSA keys crawling projects by cryptographers that have discovered several types of non-random keys with zero security.
I admit I've been on the receiving side of some notices about low value API keys. https://www.gitguardian.com for example, uses this sort of thing as a public service / sales lead I guess.