Secrets management: What should be a logical response to "but this is a private repo"

I have found a private key checked into a GitHub repository and I raised this with my lead and he waslikeb yeah that's bad we need to vault for this but immediately he asked but it's in a Private repo... unless GitHub is breached.. how could this be a thread!. I came up with generic response like this is Cloned onto devs laptops and we need to reduce the surface area! But I felt I couldn't answer his question well. …

bad breached cybersecurity github key management private private key repo repository response secrets secrets management vault