That seems bad? Look for /winnie/i in all private repos. The repo name includes the owner. Then go and arrest them.