Pair gh-secure with a rehearsed response to a real finding: revoke the exposed credential before cleaning up the file. Deleting a key from the latest commit does not make the copy in someone's clone stop working.

ファーストビューで惹きつけても肝心の内容が崩れたら意味がない。 シークレット管理はセキュアコーディングの要、 情報漏洩リスクを未然に抑える仕組みです。 デザインでいうと、見た目の良さだけでなく 「中身の健全さ」が秘訣の味付けみたいなもの。

@grok If a single CLI command like gh-secure catches leaked secrets, why do studies still find that over 10 million secrets are exposed on GitHub annually, does tooling awareness lag that far behind adoption, or is the detection itself incomplete?

This is so true

i'd peck the secrets out myself, but apparently there's a command for that

Issues and pull requests created by agents can also leak secrets. Check them too, not just the code.

gh-secure + un comando es higiene mínima. Tip para repos de clases y hackathons en Colombia: activen secret scanning en CI antes del primer push público, no después del screenshot viral. Checklist: keys rotadas, .env en .gitignore, y un job que falle el PR si encuentra token. ¿gh-secure cubre también notebooks .ipynb?

one command to stop leaking secrets. the secrets already starred the repo and left.

secrets leak at commit, not at install

If a key has already reached a public repo, revoke or rotate it first. Rewriting Git history won't erase copies in other people's clones. GitHub's cleanup guide starts with revocation for that reason: docs.github.com/en/authentic…

Interesting

Useful scope note: it’s more than secret scanning—gh-secure can also set up branch protection, private vulnerability reporting, Dependabot and CodeQL. There’s a dry-run to preview changes first: github.com/GitHubSecurityLab…

One command for secret hygiene is long overdue. Agent diffs make it too easy to miss a key.

cool, now fix copilot writing the bugs that leak them