Secrets scanning
Searching code, history, logs and artefacts for credentials such as API keys, tokens and private keys that should never have been committed.
Secrets scanners (gitleaks, trufflehog, GitHub secret scanning) combine provider-specific regexes (an AWS access key ID starts AKIA, a GitHub PAT ghp_), entropy scoring for random-looking strings, and sometimes live verification against the provider's API to confirm a key works.
They must cover git history, not just the working tree: deleting a secret in a later commit leaves it in every clone. Pre-commit hooks and push protection stop new leaks; full history scans find old ones.
The fix for a leaked secret is rotation, not a history rewrite. Assume it was copied the moment it was pushed to a public repo; automated scrapers find keys within minutes. Entropy rules generate false positives on hashes and test fixtures, so allow-lists need review.
gitleaks git --redact --report-format sarif --report-path gitleaks.sarif .