Secret scanning
Also called gitleaks, push protection
A tool that searches your code and history for things that look like keys. It looks for known shapes, like an AWS key, and for strings that look too random to be ordinary text. That second measure is called entropy.
It's a cheap check that runs whether or not anybody remembers, and it catches the mistake before the push. It's also fallible: a password with no special shape and no keyword nearby goes straight past it.
Say it to your agent
“Add gitleaks to the pre-commit hook and to CI, and run gitleaks git across the whole history once now. If it finds anything, list it and stop. Don't add an ignore rule without asking me, and treat any real hit as already leaked.”