https://github.com/search?p=96&q=gmail+password&ref=searchre...
even if they have 2-step auth setup, people choose "complete the email address" as a form of authentication which you can most likely get from their github profile.
the moral of the story here is - if you do not want someone to find it - do not publish it online
Reminds me of a story where a hosted bitcoin wallet was open-sourced right after they shut down. It was completely uploaded to github, including credentials that indirectly allowed access to an exchange where they stored a lot of their funds. It was a stupid company ran by careless people in the first place (they got hacked 2-3 times before open-sourcing an API key that was the same as a LastPass password that held their exchange password). About $350k was stolen. ($14 million by today's standards.)
https://github.com/Dao007forever/Linux-settings/blob/master/...
https://github.com/Dao007forever/Linux-settings/blob/master/...
https://github.com/Dao007forever/Linux-settings/blob/master/...
> the moral of the story here is - if you do not want someone to find it - do not publish it online
I doubt it's intentional. I will note that on Windows, if you're using ActiveDirectory, it's much more difficult to make this kind of mistake.
https://github.com/search?p=4&q=extension%3A.key+BEGIN+RSA+P...
edit: I know that it is not ethical and I am only slightly tempted to do it but is it actually illegal to use open source code in that way?
You can compare it to opening someone's home because he left his key in a public place unbeknownst to him.
You generally couldn't make the argument that 'he may have wanted people to have the key, that's why he left it in a public/open source place'. Firstly, one can't assume that, so we must hear it explicitly before it's true. And secondly, if universal open-source access was provided, there wouldn't be a key to find as there wouldn't be a lock in the first place to allow specific access. The whole point of a password or key means you do not want fully open access to all, meaning any password or key in an open-source project is likely unintentional, a mistake, and thus you'd be entering without permission which is illegal in most jurisdictions.