---
name: Secrets Scanning
description: Detect leaked credentials in code.
---
# Secrets Scanning

A secret committed to git is a live credential the moment it's pushed — public repos get scraped within minutes. Scanning catches this before it ships.

## Layers
- **Pre-commit hooks.** Catch the obvious ones before they hit git. Developer-side, fast.
- **CI / PR scan.** Block the merge if a secret is detected. Pattern-based + entropy-based to catch unknown formats.
- **Repository scan.** Detect secrets already in history (from before scanning existed). Use BFG or filter-repo to purge.

## When a secret leaks
- **Rotate immediately**, before purging. A purged secret is still valid until rotated — purging only hides it from your future self.
- Audit usage. Assume it was used; confirm it wasn't.
- Treat the leak as a security event, not a cleanup task.