Blog

Secret Scanning: Pre-commit, Push Protection and the First 30 Minutes After a Leak

Secret scanning is not one tool but layers: pre-commit on the developer machine, the PR commit range in the pipeline, push protection on GitHub and periodic scans of the whole history; after a leak the order is always rotate first, then impact analysis, and clean up history last. With real output we show why gitleaks 8.30's default rules missed two dev-prefixed secrets, Bookstore-specific rules, base64 detection and cleanup with git-filter-repo.