Deleting the file is not enough
Once a credential reaches Git, it may survive in an earlier commit, a fork, a CI cache, a release artifact, or someone’s local clone. Removing the line in a follow-up commit cleans the current tree but does not make the credential private again.
The first response is revocation or rotation. History cleanup comes after containment, along with a search for copies and a review of provider logs for suspicious use.
Move the control to the push boundary
Push protection checks changes before the remote repository accepts them. That is faster and more reliable than opening a ticket after a scanner finds an exposed token. Local hooks add another early layer, but the platform-side rule remains essential because local controls can be skipped.
Cover command-line pushes, web edits, uploads, and API writes. A bypass should be rare, explainable, time-bounded, and visible to the security owner.
- Enable blocking for known credential formats across the organization.
- Add low-noise custom patterns for internal tokens.
- Route bypass requests to a named reviewer and record the reason.
- Treat test credentials seriously when they open real third-party services.
Measure containment, not alert volume
When a key is found, record its first appearance, revoke it, inspect its use, and issue the replacement through a secrets manager. Search build logs, container layers, packages, and generated documentation—not only source files.
Useful metrics are time to revocation and the share of secrets stopped before publication. A growing alert count may only mean a growing backlog; fast containment shows that risk is actually shrinking.