Within minutes—sometimes seconds—automated bots scan the platform. These bots look for specific filenames and regex patterns (like AWS keys or database connection strings). There is a thriving ecosystem of "credential harvesting" where bad actors grab these keys before the developer realizes their mistake.