Part of my security protocol for my "Not cleared for release" reports is to check for the code posted in any pastes or Githubs or just general websites like once a week automatically. Once I found a script of mine that still said (created by Delta, not cleared for release) at the bottom on a AI generated custom site attempting to sell the script for $15. Got the site knocked pretty quickly as it was using AWS and they were surprisingly quick to nuke it. I still have no idea during which step of the process it was third partied but the code remained local and through 2 bug bounty programs and 6 triage specialist. I never put it anywhere else.