There are software such as Trufflehog ( https://github.com/trufflesecurity/trufflehog https://github.com/trufflesecurity/trufflehog ), that find secrets. We are

There are software such as Trufflehog ( https://github.com/trufflesecurity/trufflehog https://github.com/trufflesecurity/trufflehog ), that find secrets. We are using it at an organizational level, but there's always some delay from finding something and getting it reported. I've been meaning to add it both to our CI so our team can notice right away, and even to Git push hooks, to catch these cases early.