Hacker News Reader

I don’t think GitHub will send back the matching string, just the name of the repos

That seems bad? Look for /winnie/i in all private repos. The repo name includes the owner. Then go and arrest them.