Every commit token carries a Shannon entropy score over its character distribution:
H = -Σ p(c) · log2 p(c)
Real secrets (API keys, tokens) are high-entropy random strings (H ≈ 5.3 bits, σ ≈ 0.5); ordinary code is lower-entropy (H ≈ 3.0 bits, σ ≈ 0.9). The scanner flags a commit when H exceeds the threshold τ — raising τ cuts false positives but also lets some real secrets slip through unflagged (a false negative, FN).
Once a real secret is flagged, two independent clocks start racing, both memoryless (Poisson) processes:
rotation completes ~ Exponential(μ), μ = 1 / SLA
attacker compromise ~ Exponential(λ)
P(rotation wins) = μ / (μ + λ)
That closed form is the textbook result for the minimum of two independent exponential race clocks — it is why lowering the rotation SLA (raising μ) or slowing attacker reconnaissance (lowering λ) both directly raise the contained-before-breach rate. The scan batch interval adds a fixed head start to the attacker's clock: nothing rotates until a scan actually runs, so it sets the average detection latency before the rotation clock even begins. The Monte Carlo tab draws thousands of independent trials from these exact distributions and reports the empirical fraction contained versus breached, next to the closed-form value, so you can see sampling noise shrink as trial count grows and see the curve bend as you move the sliders.
- Entropy threshold — the classifier's sensitivity; trades false positives against missed real leaks.
- Scan batch interval — how often CI re-scans the repo; sets the average delay before a leaked secret is even seen.
- Rotation SLA — mean time for the credential broker to revoke and reissue a flagged secret once detected.
- Attacker discovery rate λ — how quickly automated scrapers/bots find and exploit a leaked credential once it is public.