Every commit token carries a Shannon entropy score over its character distribution:
H = -Σ p(c) · log2 p(c)
Real secrets (API keys, tokens) are high-entropy random strings (H ≈ 5.3 bits, σ ≈ 0.5); ordinary code is lower-entropy (H ≈ 3.0 bits, σ ≈ 0.9). The scanner flags a commit when H exceeds the threshold τ — raising τ cuts false positives but also lets some real secrets slip through unflagged (a false negative, FN).
Once a real secret is flagged, two independent clocks start racing, both memoryless (Poisson) processes:
rotation completes ~ Exponential(μ), μ = 1 / SLA
attacker compromise ~ Exponential(λ)
P(rotation wins) = μ / (μ + λ)
That closed form is the textbook result for the minimum of two independent exponential race clocks — it is why lowering the rotation SLA (raising μ) or slowing attacker reconnaissance (lowering λ) both directly raise the contained-before-breach rate. The scan batch interval adds a fixed head start to the attacker's clock: nothing rotates until a scan actually runs, so it sets the average detection latency before the rotation clock even begins.
- Entropy threshold — the classifier's sensitivity; trades false positives against missed real leaks.
- Scan batch interval — how often CI re-scans the repo; sets the average delay before a leaked secret is even seen.
- Rotation SLA — mean time for the credential broker to revoke and reissue a flagged secret once detected.
- Attacker discovery rate λ — how quickly automated scrapers/bots find and exploit a leaked credential once it is public.