Skip to content
CyberLens AI

Repository security guide

How to scan a git repository for secrets and risky code

Published by CyberLens AI. Last updated .

Hardcoded API keys, database passwords, private keys, and tokens committed to version control remain recoverable from every prior commit — even after deletion. AI coding tools increase this risk by suggesting inline credentials for speed.

This guide covers five practical steps: scanning full git history with gitleaks, blocking future leaks with pre-commit hooks, finding risky code patterns with Semgrep, auditing dependencies for CVEs, and verifying runtime exposure with a CyberLens AI website scan.

Start a free scan Compare repo scanners

Why git secrets are a persistent risk

Git stores every version of every file. A secret deleted from the current branch still lives in earlier commits and is recoverable with standard git commands. Treat any credential that was ever committed as compromised.

  • API keys — Stripe, OpenAI, AWS, GitHub tokens
  • Database connection strings and service role keys
  • Private keys, certificates, and JWT signing secrets
  • .env files with real values committed by accident
  • Credentials in AI-scaffolded config templates

Scanning and prevention workflow

Run a full history scan first to find historical exposure, then add a pre-commit hook and CI step to prevent future leaks.

  • gitleaks detect — full history scan, finds historical secrets
  • gitleaks protect / detect-secrets — pre-commit hook, prevents new leaks
  • Semgrep p/owasp-top-ten — risky code patterns and injection sinks
  • npm audit / pip-audit — known CVEs in dependencies
  • CyberLens AI website scan — runtime exposure after deploy

Questions and answers

What counts as a secret in a git repository?

Any credential, key, or token that grants privileged access: API keys, OAuth tokens, database passwords, private keys, cloud credentials, and service account files. Committed .env files with real values are the most common source.

My secret was deleted from the code — is it still in the repository?

Yes. Deleting a file or removing a secret from a commit does not erase it from git history. Treat any committed secret as compromised: rotate it immediately and optionally rewrite history with git filter-repo.

How does AI-generated code increase secret exposure risk?

AI tools sometimes generate inline credentials or scaffold config files with real-looking values. They may also suggest hardcoding secrets for convenience without noting that the values must be externalized before commit.

What is the difference between gitleaks and detect-secrets?

gitleaks scans full git history commit-by-commit — best for auditing historical exposure. detect-secrets is designed as a pre-commit baseline tool. Use gitleaks for audits and detect-secrets or gitleaks protect as the ongoing pre-commit hook.

How often should I scan my repository for secrets?

Run a full history scan once when you first adopt the tool and after any major code import. After that, rely on a pre-commit hook and a CI step that runs on every pull request.

Security references

CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.