Finding things
Secret scanning
Three engines over every commit on every branch, because a credential deleted last year is still in the history and that is where most of them are.
What it runs
gitleaks and TruffleHog over the clone, plus the host's own secret scanning alerts where the host has them. Three opinions rather than one, merged on the value so the same secret found twice is one finding with both engines named. A set of extra rules covers the plain username and password material the upstream rulesets are thin on: credentials in connection strings, HTTP basic auth headers and hardcoded password assignments.
Every branch, and the history
The default is every branch head and the full commit history behind them. A finding says which branches it is live in and whether it exists only in history, because the two need different responses: one is a key to rotate, the other is a key to rotate and a history to think about. A history too large to walk in one run is walked across several until it ends, which has a page of its own under Deep history.
Which branches, decided per account
The branch scope belongs on the connection rather than on one page for the whole estate, and the box offers the names past scans of that account actually walked. A branch filter typed from memory matches nothing, scans no code and reports success, which is the one failure here nobody notices. That has a page of its own under What each account scans.
The value never leaves the scan
What is stored is a hash of the secret and a mask showing the first four and last three characters. The cleartext exists inside the scan process and is stripped before anything is written. That is why the reports, the database and this website can all show a finding without showing a key.
Deciding what is real
Raw output from three secret engines on a real estate is thousands of findings, most of them examples. Entropy floors, a length floor, character diversity, patterns matched against the value and patterns matched against the path all run before anything is reported, and all of them are editable from a page in the product with a box to test a candidate against.
What it does not do
It reads. It cannot revoke a key, and it will never try: revoking is a write into somebody else's account and getting it wrong takes a production service down. The finding tells you which button to press and in what order.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.