Catch it before the commit. Know what to do if it leaks anyway.

Pre-commit and CI scanning is shift-left for credentials. When a secret leaks regardless, rotate first and investigate second — every time.

gitleaks · trufflehog

gitleaks detect --source . --verbose

# TruffleHog actually VERIFIES against real APIs —
# far fewer false positives than pattern matching alone
trufflehog git file://. --only-verified

The leak response runbook

Discovered

Rotate immediatelyDon't wait to investigate first.

Revoke the old secret

Check access logsWas it actually used?

Blameless postmortemWhy didn't scanning catch it first?

Every minute a leaked secret stays valid is a minute an attacker can use it — rotation is fast and cheap; delay is not.