gitleaks scans files or Git patches with rules, regexes, entropy, and allowlists; after a finding, revoke and rotate first rather than merely deleting a file or rewriting history.
SecretRefs keep credentials out of plaintext config, and the model-call chain sees process-local sentinels instead of the real value. But the docs say it plainly: this is not process isolation — the real value still exists in the same process's memory, and any plaintext file the agent can read bypasses the whole mechanism.