[$] Scanning for secrets

Projects, even of the open-source variety, sometimes have secrets that needto be maintained. They can range from things like signing keys, which are(or should be) securely stored away from the project's code, to credentialsand tokens for access to various web-based services, such as cloud-hosting services or thePython Package Index (PyPI). These credentialsare sometimesneeded by instances of the running code, and some others benefit from beingstored "near" the code, but these types of credentials are not meant tobe distributed outside of the project.They can sometimes mistakenly be added to a public repository, however, which isa slip that attackers are most definitely on the lookout for.The big repository-hosting services like GitHuband GitLab are well-placed to scan for these kinds of secrets beingcommitted to project repositories-and they do.