Engineering notes on building LeakWatch: secret scanning, leaked credentials, and keeping your repositories safe.
How LeakWatch's secret-detection rules moved from five hand-synced Python tables to 381 self-contained YAML files, the test that reads them independently of the loader, and the Sourcegraph false positive that migration just caught.
Recall 0.168 → 0.518 on Samsung's CredData: what the benchmark told us about regex + LLM secret detection, and the one promising idea we refused to ship.
Why real-time monitoring can't see the key you leaked in 2021, and how LeakWatch's deep scan clones your repo, replays every commit on every ref, and does it without ever being able to touch someone else's code.
How LeakWatch ingests thousands of public commits per minute without knocking over the forges' APIs: ETag caching, a rotating token pool, circuit breakers, and distributed dedup via Redis.
A calm, step-by-step guide for when you just leaked a secret to a public repo: rotate first, clean history second, check for abuse third — with the exact commands and provider links.
Inside the LeakWatch pipeline: ingesting the public commit firehose, 400+ regex patterns, heuristic and ML false-positive filtering, and strictly read-only secret validation.