GIT-04 — Leaked secret
Short answer
GIT-04 searches public repositories for committed API keys, tokens and credentials. Files committed by convention — .env.example and friends — are excluded. A finding makes this a hard blocker: the score is capped at 45, because in many companies a leaked key alone ends the process.
Impact
45
Score cap
hard blocker
15 pts
Penalty
GitHub subset · critical
What it checks
- .env files, credential files and key patterns in repositories
- The .env.example / .sample / .template exception
- Masked evidence and the file path of the finding
Why it matters
It is the harshest red flag in technical screening: it shows both a gap in security awareness and a risk to production. It is also an active risk to you — bots scan GitHub for keys within minutes.
How to fix it
Revoke or rotate the key FIRST (AWS IAM, Google Cloud Console, Stripe Dashboard) — deleting the file is not enough, the key stays in git history. Then make the repo private, add .env to .gitignore, run "git rm --cached .env", clean history with "git filter-repo --path .env --invert-paths", force-push, and commit a key-free .env.example instead.
Frequently asked questions
Is deleting the file enough?
No. The key remains in git history. Rotate it first, then rewrite history and force-push.
Related rules
How does this rule behave on your CV?
Upload your file and all 36 rules run in seconds, with every finding marked directly on the preview of your CV.