Why Git History Is a Credential Graveyard
Developers move fast. A Stripe secret key gets pasted into .env for a quick test, the file accidentally lands in a commit, someone notices and deletes it, but the damage is already done. Git history is append-only by design. That deleted file still lives in every clone of the repo, readable with a single git log or git show command.
The same pattern plays out with CI/CD configs, Docker Compose files, Kubernetes manifests, and Terraform state files. Credentials find their way in during late-night debugging sessions and stay there indefinitely. Attackers know this, and automated scanners continuously probe public repositories looking for exactly these patterns.
What Counts as an Exposed Credential?
Before you scan, it helps to know what you're looking for. Common categories include:
