What it is
GitHub secret-scanning catches the largest providers (AWS, Stripe, Google Cloud, GitHub itself) and revokes on push. That leaves a long tail of less-scanned credentials, CRM tokens, marketing platform keys, e-sign vendor keys, custom-built internal API keys, that stay live in public repositories for months. Bots harvest new public commits within minutes; live credentials get weaponized within hours.
Why it matters
Even non-cloud API keys map to lateral-movement paths. A CRM key exposes the customer list. A marketing platform key exposes engagement analytics and can be abused to send authentic-looking phishing from a trusted sender. A helpdesk key opens ticket history that names internal systems and privileged users.
The check behind the finding
Search public code for your domain name and for words like “password” or “key” next to it.
Closing it
This can be closed. Removing the file is not enough on its own, because a key that was public has to be treated as known. The assessment shows where each key was found and gives the exact steps, in order.