Secret scanning: scan existing history, and revoke an allowed fingerprint issue #277 closed: completed andymccall opened this 16 days ago · 0 comments

Follow-up to issue #268 (push protection, built 2026-10-19). Left for later: (1) a background scan of each repository's existing history with the same rules, findings on the Push protection settings page (maintainers), resolved/revoked marks; (2) a way to remove an allowed fingerprint; (3) an entropy check or generic password rules; (4) an integration test of the new-blob path; (5) telling the client when an accepted push was only partly scanned (today only the push log says so); (6) crates/hub/src/backups.rs carries AWS's documented example keys as literals: harmless (history isn't rescanned) but worth replacing before the history scan lands.