Secret sprawl: how credentials end up in 6 places you didn't expect

After scanning 1,200 repositories, the top places we find leaked credentials:\n\n1. **Git history** (47%) — deleted from latest commit but present in history\n2. **Log files committed accidentally** (21%) — local dev logs with full request headers\n3. **.env files** (15%) — .gitignore misconfigured or overridden\n4. **Test fixtures** (11%) — hardcoded for local dev, committed and forgotten\n5. **CI/CD config** (4%) — secrets printed in build output\n6. **Docker build artifacts** (2%) — ARG values baked into layers\n\nThe fix for all of these isn't better practices — it's automated scanning on every commit that blocks the push. Humans will always make these mistakes. The pipeline shouldn't let them through.