The history, not just the current files
A secret deleted in a later commit is still sitting in an earlier one, and going public ships all of it. Looking at the working files would miss exactly the thing that matters. The scan walks the full commit history instead, because that is what a stranger can clone the moment the repository opens.
What it looks for
Four kinds of thing that must not leave a private repository:
- Secrets. Keys, tokens, passwords, and connection strings, across the whole history.
- Internal identifiers. Private-range IP addresses, internal hostnames, organization domains, and local user paths that place a real person or a real network.
- Commit author emails. These live in the commit headers, where a search of the file contents never looks, so they are checked separately and must be a no-reply address rather than a real one.
- Files meant to stay local. Working notes, drafts, and the agent instruction files that are useful in private and do not belong in public source.
It also flags a license mismatch, such as a GPL Qt binding pulled in under a license that was meant to be noncommercial or permissive, because that surfaces only when someone reads the dependencies on purpose.
A skipped check is a failed check
If the secret scanner is not installed, the run does not shrug and pass. It reports a failure, because a sweep that did not happen tells you nothing, and reading no news as good news is how a real leak ships. It is the same rule the review model uses: an unclear result is never counted as clean. No scan is complete either, so it prints what it actually checked rather than a bare "clean" for a person to take on faith.
Keeping the dependencies honest
Build steps are pinned to full commit hashes rather than moving version tags, so a tag cannot be repointed to different code under you after the fact. Automated update alerts stay on so those pinned versions still get proposed bumps, which are read and merged by hand, never rubber-stamped. Once a repository is public, secret and code scanning turn on as well, both free only at that point, with push protection so the next secret is caught on its way in rather than after.