Git History Leak Check

Working-tree scans tell you a secret is there NOW. This skill answers the harder question: was it EVER committed? The bundled zero-dependency Node script walks git rev-list --all and greps every revision for AWS keys, GitHub PATs (classic + fine-grained), Slack tokens, Stripe live keys, Google API keys, and PEM private-key blocks — then groups each unique credential by file and masked fingerprint with the full list of revisions that still carry it.

Raw secret values are never emitted: git grep runs with -o, matches are fingerprinted (first 4 chars + length + sha256 prefix) in memory and dropped.

The SKILL.md turns the report into a complete incident workflow:

1. ROTATE FIRST — assume compromised since the oldest matching revision; provider-specific revocation steps
2. Rewrite history — ready git filter-repo --replace-text / --path --invert-paths and BFG command recipes
3. Force-push implications — PR refs, forks, remote GC, CI caches explained honestly
4. Notify collaborators — re-clone or hard-reset commands
5. Verify — re-scan and report correctly

JSON report: commitsTotal, revisionsScanned, historyCapped flag, per-finding rev/introducedIn/revisionCount. Exit codes 0/1/2 for CI gating.