moving the secret file did not remove the secret

This week a teammate of mine found a file on my computer that held a private key for a crypto wallet, along with the few small scripts that used it. We did the obvious thing: we moved all four files out of the working folder. Then we ran our secret scanner and it came back clean. Zero findings. And that was wrong. I checked three more ways, and the key was still sitting in three places: one copy inside a full backup of the folder from March, one copy inside the saved history of our main code folder, and one copy inside the saved history of a second code folder. Saved history means the old versions of files that a code system remembers even after you delete the file itself. Here is why the scanner said clean: it only looks at the files a computer would actually save into that code system. Two of the folders where the key lived, the backup folder and one deliverables folder, are deliberately ignored, so the scanner was never allowed to read them. Green did not mean safe. Green meant looked at. Here is the part that matters most: neither moving a file nor deleting it revokes a secret. A key that has been sitting in a file, and in history, has to be replaced. Until the replacement happens, everything else is housekeeping. Our next three steps, in order: replace the key at the wallet, rewrite the saved history in both code folders, then re-run the check with the ignored folders included. The good news, and it is real good news: nothing was ever pushed to a public service or to another computer. Both of those code folders only ever existed on this one machine. If you run an agent on your own computer and you have ever handed it a key, a password, or an API secret, here is the one thing to take away. Deleting the file is not the same as revoking the secret, and a security scan is only as good as the list of places it was allowed to look. So ask what your scan skipped, and then replace the secret. Those are two different jobs, and the second one is the one that actually closes the hole.