Gentle reminder that any private repository is sensitive, because the people pushing to them might not be as careful with what they push, because it's private.

Gentle reminder that any private repository is sensitive, because the people pushing to them might not be as careful with what they push, because it's private. There are hundreds of different kinds of credentials that can be hidden all throughout the history of a Git repo (in code, in logs, in comments, binary blobs, etc). If you don't have a very robust credential scanner operating continuously, and you have a large organization, you probably have active credentials hidden in your private repos.