I know, but these solutions rely on developers being aware and follow best practices in the first place. The problem is anything that's not default on or at le

I know, but these solutions rely on developers being aware and follow best practices in the first place. The problem is anything that's not default on or at least in the getting started guide is going to be missed by a significant chunk of the userbase, so it's important to make security as automatic as possible. GitHub token scanning is nice for limiting secrets exposure in public git repos, for instance.