School · Module 1 · Lesson 4 of 4
Turn on secret scanning before the next push
Push protection stops a leak at the git client, not after it hits GitHub.
GitHub secret scanning with push protection blocks commits that contain known key shapes. Enable it on the org or repo before the next launch.
Add gitleaks or trufflehog in CI and as a pre-commit hook for keys that GitHub does not yet recognise.
Pair scanning with the habit of never pasting keys into chat with a coding agent. Put them in a local .env that is already ignored.