This is the short argument behind a longer one. I ran my own assessment pipeline on a codebase I own and got 289 raw findings. I wrote the whole run up — file paths, the honest “zero verified live,” the lot. This piece is the thesis that came out of it: detection is solved, triage isn’t, and that’s the gap nobody’s selling.
The scanner did its job
Maybe it was gitleaks on a Friday afternoon. Maybe GitGuardian’s dashboard, or GitHub’s secret scanning turning on for the org. TruffleHog, ggshield, whatever you reached for. The number lands — two hundred, three hundred, a thousand — and you do what everyone does. You scroll, your eyes glaze, you close the tab.
Here’s the part worth saying out loud, because the marketing around these tools can make it sound like detection is the whole problem. It isn’t. Detection is solved. Gitleaks will find your secrets. TruffleHog will find them and try to verify them. GitHub will catch them at the push. The hard part was never finding them.
The hard part is the 289.
The scan is raw material. The triage is the value.
I keep coming back to that line because it’s the one nobody’s selling. A scanner hands you a wall. It does not hand you a list you can act on. The distance between those two things — between 289 rows and rotate these four this week, ignore these ninety — is judgment, and judgment is not a line item on any tool’s pricing page.
Here’s what that distance actually contains, from the run I mentioned: 289 raw findings across the full git history of 46 branches. After dedup, after liveness verification, after filtering placeholders and history, those 289 rows became four actions. Four. Not 289.
Most of it was noise. Seventy-nine were historical — secrets already rotated and scrubbed, still haunting the git history in the scanner’s eyes. Eleven were placeholders, test strings, a metric label that matched as a key. The scanner was right to flag every one of them. It was not the scanner’s job to know which ones mattered.
The part the scanner can’t do
That’s the gap, and it’s the gap that turns a dashboard you avoid into a report you open. Someone has to make the read-only calls against each credential’s provider API to check liveness. Someone has to look at an unverified result and know it means I couldn’t confirm it’s dead, not it’s safe. Someone has to separate the four real credentials sitting in HEAD from the seventy-nine ghosts in history.
The tools are honest about this, mostly. They hand you the wall and a column that says unverified and trust you to know what to do with it. Most teams don’t. The report becomes the alert nobody opens, and the secret debt just sits there.
The rotating is yours, on your side. The judgment that tells you which rotations matter — that’s the part someone has to do, and it doesn’t have to be you.