I've accidentally pushed a personal PAT(ro) to both Github and gist because of poor hygiene in personal projects, both times Github dropped the PAT and notified me.

Yeah I'm impressed they even managed to publish a personal token. My experience with GitHub's automated token recognition has also been positive (tho the tokens were never of any consequence)