Secrets Detection Pre-Commit

Catch secrets before commit.

Pre-commit hook

gitleaks; detect-secrets.

Fast; runs on every commit.

CI fallback

CI scans the diff.

Catches what hooks miss.

Respond

Detected: rotate immediately. Don't just amend.

Treat as if leaked.