project
Gitleaks is an open-source command-line tool that scans git repositories, files, and commit history for hardcoded secrets like API keys and credentials.
One developer's audit of Claude Code found 97 of 200 agent steps could run on a local model, against 4 of 100 whole requests. That makes the agent step the unit to route on, on evidence from one person's sessions and one RTX 4070.
Reality
From 11 September 2026, an actively exploited vulnerability starts a 24-hour early warning, a 72-hour notification and a 14-day final report, all timed from awareness. The artifact that decides whether you make it is your SBOM archive.
Reality
A dev.to design essay argues CI was sized for human review speed and proposes tiering checks by cost and failure probability. Its figures are examples, so the case rests on the failure modes it names.
Reality
The credential was in history[].created_by, expanded there by a RUN command that took a build argument, inside a Harbor project anyone could pull anonymously. Baseten rotated it about 17 hours after the disclosure email.
Reality
A dev.to walkthrough puts commit signing, commitlint, Gitleaks and OWASP SAST into Husky hooks, then runs commitlint again in GitHub Actions because any developer can skip the local hooks with --no-verify.
Reality
The keys work because they are keys. A standard sk_live carries refunds and sometimes payouts. The fix that matters today is rotation. The fix that lasts is a document root that refuses to serve dotfiles.
Reality
A practitioner argues the 80% coverage norm was a budget for review time, not a standard, and that any check living only in the pipeline reports to you rather than constraining the agent.
Reality
Codecov in 2021 and tj-actions/changed-files in March 2025 failed the same way: trusted third-party code running with pipeline privileges on a push nobody on your team made.
Reality
A developer's argument that .env access is an architectural bug in agent workflows, and a small Go CLI that brokers credentials at the process and transport boundary instead.
Reality