VulnerabilityEnhanced with input4 checks
Git History Secret Scanner
Walk every commit for credentials that were committed and later deleted — still recoverable, still valid, and invisible to any scan of the current code.
How this scan works
- Clones the repository’s commit history and reads the lines every commit added, across all branches — the one thing a scan of your current files structurally cannot see
- A credential committed in March and deleted in April is gone from your code, gone from the file tree, and still one `git log -p` away from anyone who clones the repo
- Separates "still in the current code" from "deleted but recoverable" — the second is the category people assume is closed because the file looks clean
- Every finding carries the commit, the author and the date it was introduced
- Unique credentials are checked once against the issuer’s read-only identity endpoint, so the report distinguishes an already-rotated key from one that works right now
- If history can’t be read, the scanner reports itself inconclusive rather than scoring a clean 100 — an unreadable history is not a clean history