“The events endpoint still lists all PushEvents even from the time it was private”
A force push does not delete the overwritten commits from GitHub. Anyone with the hash can open them with a plain URL, and the public events API hands out the hashes. Flipping a repo from private to public keeps every old push event. Only GitHub support can truly remove a commit, so the leaked key stays leaked until you rotate it.