.tip

Once a key is in git history it is in every clone and every fork, and rotating it is the only fix. A pre-commit hook catches it while it is still just a file.

# .pre-commit-config.yaml or a lefthook entry
gitleaks protect --staged

Turn on the host's push protection too, as the second net. The first net is on the laptop, before the push.