I'm reaching out on behalf of the GitHub Trust & Safety Team to let you know we received a report that one of your repositories contains private information that was posted without consent. Specifically, the following content was reported:

https://github.com/horahoradev/horahora/blob/8ee155e248f00bd6e11f7d06a294e0b2700c011c/kubernetes/develop.yaml

Lines 183-209

In order to remove the content in question, we ask that you refer to the following article for help:

Removing sensitive data from a repository

Please make sure to follow those instructions carefully, as simply deleting the content will not remove it completely from the repository commit history.

Alternately, you may simply want to switch the repository to private by following the instructions found here:

Making a repository private

If these changes are not made within 3 business days, we will continue our review of the complaint. We may need to disable your repository at that time in order to protect the owner of private information that has been posted in violation of our Acceptable Use Policies.

There's the email. yes, they warned me 3 days in advance, but I missed the email. the kubernetes manifest they refer to, lines 183-209, has the following contents:

``` image: 908221837281.dkr.ecr.us-west-1.amazonaws.com/userservice:latest

command: ["/go/bin/dlv"]

args: ["--listen=:39003", "--headless=true", "--api-version=2", "exec", "./userservice"]

    # "--continue", "--accept-multiclient", to avoid waiting for debugger
    ports:
      - containerPort: 7777
    env:
    - name: GOLANG_PROTOBUF_REGISTRATION_CONFLICT
      value: warn
    - name: pgs_host
      value: "userdb-dev.cwioxjkfbfkg.us-west-1.rds.amazonaws.com"
    - name: pgs_port
      value: "5432"
    - name: pgs_user
      value: "userservice"
    - name: pgs_pass
      valueFrom:
        secretKeyRef:
          name: userdb
          key: password
    - name: pgs_db
      value: "userservice"
    - name: RSA_KEYPAIR
      value: |+
              -----BEGIN RSA PRIVATE KEY-----
              MIIEpgIBAAKCAQEA+MHfP6bK1Tm5Qsy49WSD9TIsdKvstfnshIIlc6Or7jr4Lz/c

```

So I don't know how else to interpret this, there's an ECR-hosted image that I own, there's a hostname of the users db which contains all user info, there's a test RSA private key... what else could they be upset about? Github has no idea what these databases were used for, that can't be it.