Secret Scan

A leaked secret in git history is leaked forever — anyone who cloned has it, and deleting the file in a new commit does nothing. So this scan runs over the WHOLE history, not just the working tree, and the remediation order is rotate first, scrub second (scrubbing a still-valid key is theater).

When to run

• Before a repo goes public (the highest-stakes moment — history is about to be world-readable).
• Before any release tag (a tagged commit is what people audit).
• As a pre-commit hook (catch it before it ever lands).
• After anyone pastes a real secret into a file "just to test."

Run it

# 1. Full HISTORY scan — the authoritative one (every commit, not just HEAD).
gitleaks detect --no-banner --redact

# 2. Staged-only — fast, for the pre-commit hook.
gitleaks protect --staged --no-banner --redact