[solved?] Someone managed to steal assets in testnet

(EDIT: we found public repo in github which exposed our testnet algorand accounts)

Suddenly we lost all ASA to this account HACK7BWRUB33QUPPFQ562BRD3RO2L57TEIUEMVJW4FDVEMP7NDPZQAMAQE this morning, i never expose my algorand private key anywhere but they managed to steal all our ASAs.

how did they managed to do that?