“This week, we discovered that GitHub.com’s RSA SSH private key was briefly exposed in a public GitHub repository.”
GitHub’s own SSH private key, the one that proves you’re talking to GitHub.com, sat in a public GitHub repository. GitHub calls it an “inadvertent publishing” and swapped the key at 05:00 UTC out of “an abundance of caution.” Anyone using Git over SSH with RSA now gets a “REMOTE HOST IDENTIFICATION HAS CHANGED” warning and has to trust that the new one is real. The world’s largest code host leaked a secret in a public repo.