Secret Scanning

Secret scanning is automated detection of credentials — API keys, database passwords, private keys, OAuth tokens — that have been accidentally committed to source code, config files, or logs. Leaked secrets are one of the most common and costly breach vectors: a key pushed to a public repo can be found and abused by bots within minutes, and rotating it afterward is far more painful than never leaking it. Scanners work by matching known key patterns and entropy heuristics, and the best ones run as a pre-commit hook or CI gate so a secret is caught before it ever lands in history. For builders shipping fast, this is cheap insurance. Practical note: enable your Git host's built-in scanning and push protection, add a pre-commit scanner locally, store real secrets in a manager or vault rather than .env files that drift into commits, and if something does leak, revoke and rotate first — deleting the commit does not un-leak it.