> The exposed secrets aren't theoretical test tokens or placeholders: they include active credentials.

How do security researchers verify this?