A staging API key got into a public repo last month. Not in a config file, not in a log — in a .env that someone committed with a "wip" message and never cleaned up. The key sat in the history for eleven days. Eleven days of webhook calls from a machine I don't own. The embarrassing part: our pipeline had a linter, a type checker, and a dependency audit. It had nothing that said "hey, this file contains a live secret." The four-line fix The cheapest security control I've a...