It would be so trivial for github to inspect commits for tokken and reject them. Just one default github action.
I would guess MB simply didn't enable it on their Enterprise instance, maybe because they push too many secrets.
https://docs.github.com/en/code-security/secret-scanning/pus...