Scan Secrets

Objective

Detect secret-like material within an exact scope, minimize exposure, distinguish pattern matches from confirmed compromise, and route remediation according to reachability and publication state.

Use When

• Scanning before commit, review, or release.
• Investigating a suspected credential leak.
• Classifying whether a match is tracked, committed, reachable, reflog-only, unreachable, or published.
• Re-scanning an exact boundary after remediation.

Route Elsewhere

• Credential validation, rotation, revocation, and incident response require an authorized security workflow.
• Route history cleanup or published ref replacement to rewrite-history.
• Route ordinary code review to review-branch.