Code
Find leaked secrets
In history, in config, in CI, plus what to rotate and in what order.
Fill it in
Where to look.
A rotated key is still in the old commit.
Ordered so nothing goes down mid-rotation.
Your prompt
Find the secrets in [the repository]. Search the full history, not the working tree. A key removed in a later commit is still in the pack file, still in every clone, and still valid: deleting the line changes nothing except who can see the problem. Look where they actually leak: committed config, CI variables echoed into logs, .env files that made it in, test fixtures with real credentials, and long-lived tokens in a README. Verify before reporting. A high-entropy string is not a secret, and an audit that reports forty false positives gets skimmed and the real one gets missed. Say which you confirmed live and which are candidates. Write the rotation runbook in ORDER. Rotating the database password before the application can read the new one is a self-inflicted outage during a security incident.
Use Find leaked secretsOpens with everything above already filled in.
Why this works
A key removed in a later commit is still in the pack file, still in every clone, and still valid. This searches the full history, verifies before reporting so the real finding is not buried in forty false positives, and orders the rotation so nothing goes down mid-incident.