Adopt it in a repository that already exists
scan --tracked checks everything Git tracks once. A known old token is accepted by fingerprint and path with nosecrets ignore; the entry lives in .nosecretsignore and shows up in code review.
Adopt it in a repository that already exists
site/captures/usecases/adopt/# legacy/import_users.py
# One-off migration script from 2021.
GITHUB_TOKEN = "ghp_R2kT9xLm4Qv7Bn3Zc8Wd5Hf1Jg6Ys0AaPeXq"
# src/app.py
import os
TOKEN = os.getenv("GITHUB_TOKEN")$ nosecrets scan --tracked legacy/import_users.py:2:17 [CRITICAL] GitHub Personal Access Token (github-pat) nsi_5e31772c2cb9 preview: ghp_...PeXq $ nosecrets ignore nsi_5e31772c2cb9 --path legacy/import_users.py Added ignore entry to .nosecretsignore $ cat .nosecretsignore nsi_5e31772c2cb9:legacy/import_users.py $ nosecrets scan --tracked No secrets found