Scan every place text and files are stored, not only source code: issues, pull request comments, wikis, CI logs, container image layers, build artifacts, packages and configuration exports. Secrets travel with people and pipelines, so a repository scan finds only the part that happened to be committed.
Why git is only the start
A scanner on commits catches the classic mistake. But a developer pastes an error message with a token into an issue, a build prints its environment, an image bakes in a file. Each of these is outside the commit history.
GitHub's secret scanning documentation lists a broader scope than code for this reason. It covers git history on all branches, plus issue descriptions and comments, pull request titles, descriptions and comments, discussions, wikis and secret gists. Your own coverage should be at least as wide.
Surface checklist
| Place | How secrets get there | What to do |
|---|---|---|
| Git history, all branches | Committed config, keys | History scan, see below |
| Issues and pull request comments | Pasted logs and errors | Enable platform scanning, review exports |
| Wikis and docs | Setup guides with real values | Periodic scan, use placeholders |
| CI logs | Printed variables, verbose flags | Masking, no debug output of secrets |
| Test reports and artifacts | Dumps, fixtures, environment files | Scan artifacts, short retention |
| Container image layers | Copied files, build arguments | Scan images, use build secret mounts |
| Published packages | Included config or key files | Scan before publish |
| Chat and tickets | Pasted for convenience | Detection if available, training |
Related posts for each surface
- CI output: secrets in CI test logs and artifacts
- Images: a deleted secret in a later image layer is still there
- History: how to scan full git history
- Chat: a secret pasted in chat
A rollout order
- Start with repositories and pull requests, where tooling is mature.
- Add CI logs and artifacts, since they are generated automatically and often forgotten.
- Add container images and packages at build time.
- Add wikis and tickets with a scheduled scan.
- Assign an owner per surface, since each belongs to a different team.
Prevention beats scanning
Scanning finds leaks after they happen. Prevention reduces them: short lived credentials, secret masking in logs, build secret mounts instead of build arguments, and push time blocking. OWASP's cheat sheet recommends scanning during development, for instance in the IDE or with pre-commit hooks, and using more than one detection tool and correlating results.
Quick check
Do I need a separate tool for each place?
Not necessarily. Some tools cover several surfaces. What matters is that each surface is covered, and that each has an owner.
Which surface is most often forgotten?
CI logs and build artifacts, because they are produced by machines and nobody reads them until something goes wrong.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a container image is inspected layer by layer, one of the surfaces in the table.
Safeguard scans repositories and container images, and you can try a free scan.
Sources
Last reviewed: 19 October 2026.
