Which is in fact what they did (or even worse they didn't delete them at all): https://discuss.circleci.com/t/circleci-security-alert-rotat...