GitHub, for one, tries to stop them from being published by doing some scanning as well:

https://help.github.com/en/articles/about-token-scanning