> ## Content Index
> Fetch the complete content index at: https://blog.alantaranti.me/llms.txt
> Use this file to discover other available public pages before exploring further.

# Code review won't catch a leaked credential
- URL: https://blog.alantaranti.me/thoughts/code-review-wont-catch-a-leaked-credential/
- Published: 2026-08-05T00:39:19.000Z
- Updated: 2026-08-05T00:39:19.000Z
- Description: A secret doesn't look different from any other config line in a diff — why code review structurally misses this, and what closes the gap
- Author: Alan Taranti
- Tags: #thought, security, git, code-review

Caught a password leaked into git today — staging, nothing near prod.

Code review didn't catch it, and that's not a reviewer failing: a secret doesn't look different from any other config line in a diff.

Rotating the credential closes the incident. It doesn't close the diff.

What pre-commit scanner do you run to catch this before it merges?