Publishing Without Publishing Yourself
361 commits in mojo-baro's history carried a private email address that is invisible in every checkout of the repo, because it lives in commit metadata, not tracked files. The Android repo separately carried 112 MB of committed build output. Neither would have been caught by reading the code.
Read