Because its a *private* repository he was supposed to be uploading to. In private repositories we do things like store keys and binaries because we abuse Github for non-build purposes, like the ability to git pull remotely and have a complete working copy of our code. Despite Github not being a backup service, our own private repositories where we work contain private keys, license files, database backups, all sorts of dll binaries. Convenience, ne? Until something like this happens.