I do most of my work on private codebases so I went that direction. I had intended to add a qualifier for that but I missed my window to edit. Agreed there are

I do most of my work on private codebases so I went that direction. I had intended to add a qualifier for that but I missed my window to edit. Agreed there are many ways that working with public repos makes everything dramatically more difficult. I’m pleased to see GHAS secret scanning become free. I’m not clear if that would include the pre-push secret scanning feature. If so you have a really decent toolset for prevention and detection. Remediation should be as easy as key rotation. Except keys get reused and rotation affects all users... if the keys can’t be rotated it’s a big chore for private repos owners, but de facto impossible with public codebases. There is no way of knowing who has cloned it (without paying for enterprise audit logs).