scanning-leaked-secrets

Scan a target repository's working tree and its checkout's git history for leaked secrets via one pinned external CLI, betterleaks -- betterleaks dir for what sits on disk now (tracked or not), betterleaks git for content reachable only through history, including a file removed from the tree -- redacting every secret value before it reaches the report (betterleaks' --redact flag, this skill's own pass over the fields it misses, and a re-scan of the report) and reporting findings otherwise unmodified. Use when auditing for leaked credentials, screening a target before merging or accepting a contribution, or asking whether a secret ever entered history even if since deleted. Report-only, never auto-remediating. Distinct from scanning-attack-surfaces, whose Mode B checklist reports a GitHub repository's native secret-scanning feature-toggle status as one item among many hosting-configuration checks; this skill is a dedicated, platform-independent, on-demand scan of working tree and history, on any target.