FWIW Github already scans your commits for Github OAuth tokens and revokes any tokens it found. Doesn&#x27;t prevent you from checking in SSH keys or anything like that but it&#x27;s something, right? (Source: I did this once with a non-priviledged token. Oops.)