Sadly, it seems that the lesson from this, is to keep your repos private.

I am not a fan of that, but I think many folks will take that away from this.