Secret scanning that does not train people to ignore alerts

Teams burn out on secret scanning when a AWS key in a test fixture, a placeholder in a README, and a live token in last night’s commit all page the same channel. The fix is not a better regex. It is splitting prevent, detect, and respond so the loud path is reserved for credentials that can still be used.

Prevent in the developer loop

Pre-commit and a push protection rule at the git host catch the live key before it is history. Use a small, high-precision ruleset there: well-known tokens, private keys, the cloud access-key pattern. Do not enable every generic entropy rule on the laptop. You will train people to skip the hook.

Detect in history and in runtime

Historical scans belong in a weekly job with a ticket queue, not in Slack. Runtime detection — the key was used from an ASN you have never seen — belongs to the incident channel. Those are different SLAs. If your scanner cannot tell them apart, you will respond to all of them at the historical pace.

• Rotate on confirm, not on debate. A key that matched a provider pattern and was committed this week is revoked first.
• Keep a documented allowlist for test fixtures that are not credentials. Put the allowlist in git.
• Measure dwell time from commit to revoke. That is the number that matters, not findings closed.