How to Scan a Project for Leaked Secrets Before Pushing to GitHub

Use this right before any git push to a public repo, especially for a project where credentials were pasted directly into a tool's UI at some point, not just stored in a .env file.

Steps

Before committing, grep across every file for patterns real secrets tend to follow:
```
grep -rn "AIzaSy\|password\|Password\|-----BEGIN" .
```
Also search for anything specific and identifying to your own setup: your actual database hostname, your actual chat ID, your actual project reference string, anything you'd recognize as "mine" rather than a placeholder.
Review every match manually, most will be harmless (instructional text mentioning the word "password," a variable named password with no value), but check each one rather than assuming.
Only after a clean scan, commit and push.

Gotcha

A file can look completely safe on a visual skim and still contain a real value buried in a long line, especially inside JSON or a URL query string where a key might be sitting after ?key= in the middle of a long line that doesn't visually stand out. Grepping for known patterns catches what skimming misses.

Quick reference

grep -rn "AIzaSy\|password\|api_key\|secret\|-----BEGIN" .

Empty output, or only clearly harmless matches, means it's safe to push.