Break It: finding secrets in a deliberately messy repository

What we did

The setup A small repository with a history worth reading: keys committed and reverted, a .env that briefly existed, a CI log that says more than it should.

Hands on Work through it with whatever tooling you like. We will compare what grep finds against what reading the history finds.

Afterwards What would have caught each of these before it was committed, and what would that have cost the person committing it?