# Blog — LeakWatch

> Engineering notes on building LeakWatch: secret scanning, leaked credentials, and keeping your repositories safe.

Source: https://leakwatch.net/blog

---

[← LeakWatch](/)

# Blog

Engineering notes on building LeakWatch: secret scanning, leaked credentials, and keeping your repositories safe.

[

## One rule, one file: 381 self-contained YAML rules, and the false positive that slipped through

How LeakWatch's secret-detection rules moved from five hand-synced Python tables to 381 self-contained YAML files, the test that reads them independently of the loader, and the Sourcegraph false positive that migration just caught.

September 2, 2026· 6 min readengineeringsecret-scanningdetection-rulestechnical

](/blog/one-rule-one-file)[

## Tripling our secret scanner's recall: what the benchmark told us, and what we refused to fix

Recall 0.168 → 0.518 on Samsung's CredData: what the benchmark told us about regex + LLM secret detection, and the one promising idea we refused to ship.

August 15, 2026· 29 min readengineeringsecret-scanningbenchmarkllmtechnical

](/blog/tripling-our-secret-scanner-recall)[

## Deep scan: reading your entire git history, not just the last commit

Why real-time monitoring can't see the key you leaked in 2021, and how LeakWatch's deep scan clones your repo, replays every commit on every ref, and does it without ever being able to touch someone else's code.

July 26, 2026· 9 min readexplanationdeep-scangitarchitecturetechnical

](/blog/deep-scan-your-whole-git-history)[

## Consuming the GitHub, GitLab and Codeberg firehose at scale: ETags, rate limits and dedup

How LeakWatch ingests thousands of public commits per minute without knocking over the forges' APIs: ETag caching, a rotating token pool, circuit breakers, and distributed dedup via Redis.

July 21, 2026· 6 min readexplanationarchitecturefirehosetechnical

](/blog/consuming-the-firehose-at-scale)[

## I accidentally pushed an API key to GitHub : here's exactly what to do

A calm, step-by-step guide for when you just leaked a secret to a public repo: rotate first, clean history second, check for abuse third — with the exact commands and provider links.

July 21, 2026· 6 min readguidesecret-scanningincident-response

](/blog/i-accidentally-pushed-an-api-key-to-github)[

## How LeakWatch's secret scanner works

Inside the LeakWatch pipeline: ingesting the public commit firehose, 400+ regex patterns, heuristic and ML false-positive filtering, and strictly read-only secret validation.

July 20, 2026· 4 min readexplicationsecret-scanningarchitecture

](/blog/how-leakwatch-secret-scanning-works)

LeakWatch

Secrets leak into public commits every minute. This watches the forges for yours. Built and run by [Gabriel Diyan](/about), a cybersecurity student — [why LeakWatch exists](/about).

Scan

-   [Product](/product)
-   [Live feed](/leaks)
-   [Trends](/leaks/trends)
-   [API docs](/docs)
-   [CI/CD](/docs?tab=ci)

Read

-   [Blog](/blog)
-   [Changelog](/changelog)
-   [About](/about)

Verify

-   [Security](/security)
-   [Privacy](/privacy)
-   [Terms](/terms)
-   [Legal](/legal)
-   [Contact](/contact)
-   [Status](https://status.leakwatch.net)

© 2026 LeakWatch

[GitHub](https://github.com/Leakwatch-Scan)[X](https://x.com/LeakwatchScan)