Secrets Scanning
Secrets scanning automatically checks source code, commit history, and configuration files for accidentally committed sensitive credentials — API keys, passwords, private certificates — before or after they're pushed to a repository, since a leaked secret in git history can remain exploitable indefinitely, even after being "removed" in a later commit.
A secret committed to git and later deleted in a subsequent commit is often still fully recoverable from the repository's history — simply removing the line in a new commit doesn't erase it from earlier commits, which is why scanning needs to check the full commit history, not just the current state of the files.
Most secrets scanning tools (GitHub's built-in secret scanning, TruffleHog, GitGuardian) run automatically on every push and can block a commit outright before it's ever merged, treating a detected secret as a build-breaking failure rather than a warning to be quietly acknowledged and ignored.
