Checks · SEC-002

SEC-002 · Secret in git history

Why it matters

Deleting a file does not remove it from old commits. Anyone who can clone the repository can still read the old key.

How we detect it

The secret scanner looks through recent commit history, not only the current files.

How we fix it

Rotate the key so the old value stops working. History is not rewritten.

Can it be fixed automatically? Instructions only

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret
• SEC-005 · AI provider key used from browser