Wouldn't the attacker need to breach your git server first before that was leaked?