Secrets leak into repositories all the time: a key pasted into a config file to get something working, an env file committed by mistake, a token left in a test. Once a secret is in git history, deleting the line does not remove it. Anyone with access to the repository, or a public copy, can read it.
Secret scanners look for known key formats and high-entropy strings. Some run on your repository after a push, some run on your machine before a commit, and hosting platforms can scan public repositories and notify the service provider so it can revoke the key. AI assistants make leaks more likely because they happily paste real keys into example code and files.
Turn scanning on for every repository, ideally with a check that blocks the commit. If a scanner finds a live secret, treat it as compromised: revoke or rotate it first, then clean up the code, then check the provider's logs for unexpected use. Removing it from history is a second step and never a replacement for rotation.