video1.0<iframe src="https://www.loom.com/embed/5412952d1929478fb41f6dd9d2ba7fd5" frameborder="0" width="1848" height="1386" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe>13861848Loomhttps://www.loom.com13861848https://cdn.loom.com/os/loom-media-content/loom/2b3001f4-17ac-4947-b547-99c719997307/8c6bdec2-1c7c-4a66-a6a7-f33fded05d75/sessions-thumbnails-5412952d1929478fb41f6dd9d2ba7fd5-8d1c7abcd2536701.gif/binary?authToken=eyJraWQiOiJtaWNyb3MtZ3JvdXAvdGRwLW9zLWFyY2hldHlwZS9icGprbnJwYWNrdmRwdjNtIiwiYWxnIjoiUlMyNTYifQ.eyJicyI6Imxvb20tbWVkaWEtY29udGVudCIsImF1ZCI6InRkcC1vcy1hcmNoZXR5cGUiLCJuYmYiOjE3ODk0MDk3MzEsInRpIjoiNDNjNThmMzEtN2UyZC00YTZhLTlhOTMtNWUxN2M2NDYyNjQ1IiwiYWRpIjoibG9vbS9sb29tIiwiaXNzIjoibWljcm9zLWdyb3VwL3RkcC1vcy1hcmNoZXR5cGUiLCJwaWQiOiJhZTRiYWZjMC1lNTE0LTRiZmQtYjMxYy00NmUyZGFlOTdkZGIiLCJ3YSI6ImZhbHNlIiwib2lkIjoic2Vzc2lvbnMtdGh1bWJuYWlscy01NDEyOTUyZDE5Mjk0NzhmYjQxZjZkZDlkMmJhN2ZkNS04ZDFjN2FiY2QyNTM2NzAxLmdpZiIsImV4cCI6MTc4OTQxMDMzMSwiaWF0IjoxNzg5NDA5NzMxLCJqdGkiOiJkODBlN2FjZi0xYzY3LTQ3MjctOWJhMS1iNWZkYTljNjJkOTUifQ.ST4A8B1Q5kyq2AVJaH_w_PCltNdqlnRWPZ-l2a6O3eIfKfuaXRedmO9_7Vwbb6uVfvMgCrWZOVDn56vIUWBk4A68e0MvyPm4eImSZYCcvTLDsV8vGUA6CsL1j13wb2lN9s4UxA8lLh-Wn5ko-6PRXeGqMUhMC2_UzdpnHfHizJ_K8zV1OpmVn2FEaUPQ6IpJdFuAxd7W6goBoEnrs9cuB-La7iDk6L2j7Q9IceeZokGSYQVc74HErk-g0U7NU_XHXPnzJBO1Xo0n2EPW3v3oCMOF3n9Z06x6HdCw_p_de5ZMja8xbOychV2kzgMSoIbRSTvlwcwEvDwLYbbIOhQJfw&Expires=1789410331&Signature=LECN4%7EwMQctPvd-kkCOxVqH02BpZKRmDO2INOyfD-NvJ8hvUcnds4Efztgo0vl3rYbQtAflnIe9NNrg8%7EfTHdlF4-mCf5VMsu62c6bXnFBX8xDSunxreFmkbl5TPBg0pKW5Um9T1fM7QAf3Pm6Pi5UmPqXsCNO1x6DcgERHHKIXfBKkkx5uYGWTxWMpIDrC7n%7ENxlxqpnNax%7EiEn2NX4vabeEkGRlD9NokHzHYxiRdaLzpFkCYo28Eh3ZdKnxYwtLZG%7E%7EPWNEqWSzKwuF1b%7E0wSM7%7E5omlOPS5k%7EQT%7EL2%7EExynBj7fJBEdXRl5EHiW1Rbjf1UF9I-92jjfDwL5YC1w__&Key-Pair-Id=KQOSYIR44AIC0362.624This Loom explains the design and performance of a Git secret scanner that detects leaked files even after they are deleted from later commits. It describes how demos show a .env key added in one commit and removed in two commits, yet scanners like Hyslick still find the original introducing commit and redact the key with exit code 1 to fail CI. Instead of comparing commit trees, it scans Git objects directly by enumerating every object in the database, then runs additional checks only for flagged blobs. In a real repo of about 27,000 objects, it reported 1,968 findings with no real ones, with about 1,900 high-entropy hits from a public certificate and around 1,960 from user pass host patterns in documentation. Finally, it emphasizes structural detection over entropy, fixes an unbounded cache that could grow to 172,000 entries, and reduces scan time from 172 MB to 87 MB and completes in 17 seconds while remaining single-file standard-library only.