Secret Leak Scanner 🛡️

Catch leaked keys before they push — and rotate the right way when one slips.

A leaked credential is compromised the moment it hits a remote — bots scan public
pushes within seconds. This finds them first, and when one already leaked, it gets
the order of operations right (rotate before you scrub history).

What it does

• Scans staged changes, the working tree, and full git history.
• Catches provider key shapes (AWS, GitHub, Stripe, Google, Slack, OpenAI/Anthropic),
  private keys, committed .env/.pem/credentials, and hardcoded creds.
• Signal over noise — placeholders and $ENV references don't cry wolf.
• Remediates in order — rotate → purge from history → move to env → add a pre-commit hook.

Example

You: "I just pushed a commit with my AWS key 😬"
Secret Leak Scanner: Treat it as compromised — rotate/disable that key in AWS now
(bots scan public pushes in seconds). Then I'll purge it from history with git filter-repo,
force-push with --force-with-lease, move it to env, and add a pre-commit scan so it can't recur.

When to reach for it

• "Scan before I push" / "is this safe to push?"
• "Did I commit a secret/key?" · "I leaked a token — what now?"

Why it's different

It doesn't just detect — it gets the remediation order right. Scrubbing history
without rotating first is the classic mistake: clean history, still-live key.