---
title: "Scan the whole history for secrets · Agent Wranglers"
url: https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan
id: TKO-31
level: Required
risk: takeover
updated: 2026-10-22
tokens: 872
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Scan the whole history for secrets

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: TKO-31
- Level: Required
- Chapter: [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)
- Rule: Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.
- Check: The scan report covers every branch and every commit, and lists 0 verified live secrets, or each live secret has a revocation date before closing.
- Risk: An account or system taken over
- How: A key deleted from the code years ago is still in the history, and anyone with a copy can use it. A scanner that verifies keys against their service, such as TruffleHog or Gitleaks with verification, separates live keys from dead ones. Scan forks, archived repositories and the builder's export too. The ongoing rule is [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code.md), with a scanner from [Use TruffleHog to find leaked secrets](https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
trufflehog git file://. --results=verified --fail
gitleaks git --log-opts="--all" --report-path gitleaks.json
```

## Sources

- [GitHub on secret scanning](https://docs.github.com/en/code-security/secret-scanning/introduction/about-secret-scanning)
- [GitHub on removing sensitive data](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository)
- [OWASP Secrets Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html)

## Related rules

- TKO-2 [Rotate every secret the previous team could read](https://agentwranglers.se/playbook/codebase-takeover/triage/rotate-inherited-secrets.md) in Codebase takeover
- SEC-33 [Keep secrets out of code](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code.md) in Adversarial testing
- STK-50 [Use TruffleHog to find leaked secrets](https://agentwranglers.se/playbook/stack/testing-and-code-quality/secret-scanner.md) in Software choices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan">Agent Wranglers codebase takeover playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Ask the team to explain the critical paths without AI](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/explain-without-ai.md)
- Next: [Test the access rules on the running product](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/test-access-rules.md)
- [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md)