“This is known by GitHub, and intentionally designed that way.”
Delete a fork, delete a repo, or open-source a private one, and the old commits stay reachable to anyone with the hash. A four-character short hash has only 65,536 values to brute force. Truffle found 40 valid API keys in deleted forks of three repos from one large AI company. GitHub answered the report with a link to its docs. Deleted on GitHub means hidden from you.