Post

20,000+ secret scanning alerts across 15,000 repos. Nine months later, GitHub reached inbox zero.

The key was separating noise from real risk, validating active credentials, finding owners, and making remediation a shared responsibility across engineering.