Actually, github monitors for that. They discuss it a bit at https://help.github.com/en/articles/about-token-scanning, although the list of companies is a bit outdated.