Secret scanning
Automated hunting for API keys and passwords committed to your repo or its history, ideally before anyone else finds them.
See it
What it is
Scanners like gitleaks, trufflehog, and GitHub's built-in secret scanning match known credential shapes (a Stripe key starting sk_live_, an AWS key starting AKIA, a JWT's three dot-separated chunks) and back that up with entropy heuristics for strings that look suspiciously random. They run in three places: a pre-commit hook (cheapest), CI on every push, and a full sweep of the entire git history.
Turn it on the day you create the repo, and again the day you make it public. GitHub push protection, which rejects the push outright, is the version that genuinely saves you, because bots watching the public event firehose find fresh keys within seconds and spin up crypto miners on your cloud account before you have finished your coffee.
Deleting the line does not delete the secret. It lives in history forever, and rewriting with git filter-repo or BFG still does not help if anyone cloned the repo or a fork cached the old commit. The only real fix is rotation: revoke the key, issue a new one, then clean history for tidiness. Expect false positives on test fixtures too, and allowlist them in the config rather than turning the scanner off.
Ask AI for it
Add secret scanning to this repo end to end. Install gitleaks with a config tuned to this stack, wire it as a pre-commit hook through lefthook or husky, and add a CI job that fails the build on any finding. Then run a full scan of the complete git history and report every hit with commit, file, line, and provider. For each hit, tell me whether the credential is still live and the exact revoke-and-rotate steps for that provider. Allowlist obvious test fixtures in the config instead of lowering the entropy threshold, and enable GitHub push protection if the remote supports it.