Secret scans are cheap compared to rotating keys

A scanner is cheap. Rotating a real credential after it lands in history is not.

Leaks arrive through normal work: an env file in an issue, a test fixture, a pasted token in docs, a generated config, a screenshot, a service-account file, or a debug log. Scan where those values enter: local commits, pull requests, generated files, docs, artifacts, and test data.

A finding needs classification:

• real secret
• test credential
• public example
• intentional fixture
• generated false positive
• needs investigation

Real secrets should be revoked or rotated. Examples should be obviously fake. Intentional fixtures should be documented. A scanner full of ignored noise becomes background.

Use placeholders that do not resemble live credentials:

OPENAI_API_KEY=replace-with-your-openai-api-key
AWS_SECRET_ACCESS_KEY=replace-with-your-aws-secret

Generated files need attention too. Ignore rules reduce accidental staging; scans catch files the rules miss:

.env
.env.*
!.env.example
*.pem
*.key
service-account*.json
.local/
tmp/

Agents make the control more important because they move text quickly and may copy realistic-looking values into configs, docs, or fixtures. Keep real secrets out of repo-readable files, scan diffs and generated output, and review agent-created configuration.

The response runbook can stay short:

1. stop the merge
2. identify the credential type
3. notify the owner
4. revoke or rotate if real
5. remove it from the diff
6. check remote history
7. add a fixture or ignore rule only for a false positive

Secret scanning will miss some cases and flag harmless ones. It still changes the economics in favor of prevention.