Once a bot finds a password.txt file:
A common scenario involves a developer pushing a .env file containing an AWS Secret Access Key. Within hours, the attacker uses the key to spin up expensive EC2 instances (cloud servers) to mine cryptocurrency. By the time the developer realizes the mistake, they have racked up thousands of dollars in cloud bills.
Force push the cleaned branch to GitHub to overwrite the exposed history.