The scanner is two independent tests per path, and each one can return nothing. First the filename, lowercased, against seven substrings: `.env`, `id_rsa`, `id_ed25519`, `credentials`, `service-account`, `.pem`, `.p12` [13]. Then the contents, read as text with decode errors ignored and truncated to the first 200,000 characters [14], against five regexes: a generic api_key/secret/token/password assignment, `AKIA` plus sixteen uppercase alphanumerics, a PRIVATE KEY header, a postgres URL, a mongodb URL [12]. Twelve heuristics in total [1]. A path is printed only when one of them fires [17].
On the article's own example the coverage is generous. `secrets/dev.pem` trips the `.pem` hint, `.env` trips the `.env` hint, and a `DATABASE_URL` in `postgres://` form trips the db_url pattern as well [10][2]. Change the file and the coverage thins. An ignored debug log with the connection string sitting past byte 300,000 is outside the read window [3]. A Stripe key isn't among the five patterns, and neither is an Azure connection string or a base64-encoded service account blob, so none of them print [4]. What the clean run actually reports is no match against twelve heuristics, which is a narrower statement than safe to attach [5].
The enumeration has a boundary too. `git ls-files -o -i --exclude-standard` returns the untracked, ignored paths inside the repository [11], while the agent, in the post's phrasing, walks the working tree with a flashlight and reads whichever path a tool policy still allows [9]. Credentials that live in a home directory were never in the working tree, so git has no opinion about them and never offered one [6]. The listing is a subset of the read surface. The part it omits is exactly the part git cannot tell you about.
The dev.to post argues from mechanism rather than from incident. It names no client, publishes no measurement of how often an agent opens a `.env`, and presents the script as a local proposal that contacts no model and uploads nothing [15][7]. For the threat model to transfer to your machine, the client has to pack nearby files without being asked [4], its tool policy has to permit the paths your gitignore covers [2], and your ignored tree has to hold live credentials rather than fixtures. The first is described as default agent behaviour [4]. The other two are checkable in an afternoon.
The command is the part worth adopting first. It converts a habit (these files are private because I never committed them) into a list you can read as an attachment manifest before a session starts [11][3]. Whether you keep the author's regexes matters less than whether anything at all reads that list, because the post's own framing puts the leak in the envelope assembled around the chat box rather than in the text you typed [18].
