Each gate is a real prevention point used in production CI/CD: a pre-commit hook runs a scanner on staged files on the developer's own machine before the commit object is even created — the cheapest place to stop a leak ("shift left"). A pre-receive hook on the git server re-checks every pushed object as a second line of defense if the first was bypassed (e.g. git commit --no-verify). A CI/CD pipeline scan is the last gate before a deploy or a public push reaches the outside world.
Detection combines two real techniques: regex patterns for known key formats (e.g. AKIA[0-9A-Z]{16} for AWS access keys) and Shannon entropy analysis of each token — H = -Σ p(x)·log2 p(x) over the character distribution. Random key material has high entropy (~4.3-4.8 bits/char); normal source code and prose sits much lower (~3.0-3.5 bits/char), so a high-entropy string flags even key formats the regex list has never seen.
H(s) = -Σ p(c)·log2 p(c) for each char c in s
threshold ≈ 4.0 bits/char ⇒ likely secret
- Scanner on (Pipeline A) — the secret is caught at gate 1 and the commit never leaves the developer's machine.
- Scanner off (Pipeline B) — nothing blocks the key; it reaches the public repo, and automated bots that continuously crawl GitHub for exposed credentials can find and abuse it within minutes.