Secret scanning
Last verified
Secret scanning detects credentials in repositories, history, logs and build artefacts. GitHub, GitGuardian, gitleaks and trufflehog all do it.
The uncomfortable symmetry: attackers run the same class of tooling against the public event stream, continuously. Whoever scans first wins.
Push protection — blocking a commit containing a recognised secret pattern — is the highest-value version, because it stops the mistake at the only moment it is free to fix.