Quantify hardcoded secret exposure across repositories: scan coverage, finding precision, unrotated live secrets and total exposure days.
Coverage is discounted by history depth because a pre-receive hook only stops the next secret, not the four thousand commits already pushed. The score is driven by unrotated live secrets rather than raw findings, since a finding you have confirmed and rotated has cost you time but no exposure, while one confirmed production key you have not rotated is an open door. Secrets in git history are effectively permanent — forks, clones, CI caches and mirrors all keep the blob — so the only remediation that counts is rotation, and cumulative secret-days is the number that shows how long you have been leaving that undone.
Secrets Exposure
Effective scan coverage = scanned repositories ÷ all repositories × 100 × history-depth factor, where full history counts 1.0, default branch 0.7 and new commits only 0.4.
Exposure scoring
Exposure score = 2 × unrotated live secrets + 4 × production-privilege secrets + 1.2 × public repository percentage + 0.2 × uncovered percentage, clamped to 0–100.
Effective scan coverage = scanned repositories ÷ all repositories × 100 × history-depth factor, where full history counts 1.0, default branch 0.7 and new commits only 0.4. Coverage is discounted by history depth because a pre-receive hook only stops the next secret, not the four thousand commits already pushed. The score is driven by unrotated live secrets rather than raw findings, since a finding you have confirmed and rotated has cost you time but no exposure, while one confirmed production key you have not rotated is an open door.
Secrets in git history are effectively permanent — forks, clones, CI caches and mirrors all keep the blob — so the only remediation that counts is rotation, and cumulative secret-days is the number that shows how long you have been leaving that undone.
This calculator takes 9 inputs: Source repositories, Repositories with secret scanning enabled, Public or internet-visible repositories, Secret-scanning findings, Confirmed live secrets, Confirmed secrets already rotated, Average age of an exposed secret, Confirmed secrets with production privilege, Commit history depth scanned. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Not reliably. Rewriting drops the commit from your branch, but the blob survives in forks, clones, pull-request refs, CI caches and any mirror, and on most platforms the original commit stays reachable by SHA. Rewrite if you like, but the secret is burned the moment it is pushed: rotate it.
Because low precision destroys the response process. If two thirds of findings are test fixtures and example keys, engineers stop triaging them, and the one real production key arrives in a queue nobody reads. Tune detectors and allow-list known-safe patterns before asking for faster response times.