Caught a password leaked into git today — staging, nothing near prod.
Code review didn't catch it, and that's not a reviewer failing: a secret doesn't look different from any other config line in a diff.
Rotating the credential closes the incident. It doesn't close the diff.
What pre-commit scanner do you run to catch this before it merges?