Looks good. Hopefully someone will write something to automagically search for unintentionally exposed sensitive files and notify the repo owner - when the "human" version of Code Search came out, a lot of private keys and other such things were discovered.
I'm sure malicious bots do try to mass message repository owners through Github. It's called spam and every platform over a certain size experiences it. I expect Github already has measures in place to block it.
When I searched Github it seemed like most of the supposedly leaked passwords were actually examples or placeholders and not a problem.
It would be one thing if Github ran (or at least sanctioned) a feature that warned you of possible security problems, but I don't think I'd like potentially multiple, poorly-coded bots going around messaging repo owners.
I suppose there are already templating abilities written into the popular code editors, but something that maybe takes the first two or three lines of what you've written (maybe a common JDBC connection style block) and identifies it as such. I'm not sure if it would be incredibly useful but it would be interesting to see what came of it.
To me, Github search is kinda useless. When I search for anything Android related (i.e. usage search for some framework type), I get a billion copies of the main Android source. The signal to noise ratio is almost 0..
