The token on a branch nobody merged
A scan of main came back clean, but the repository has other branches. Search every branch for the API token that leaked, find the branch, and the file it sits in.
Briefing
The payments-sdk repository was public for a week by mistake. A secret scan of main found nothing, so the incident was nearly closed.
git log on its own walks the current branch only. git log --all walks every branch, including ones that were never merged.
dev-laptop · Secrets in Git
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.