Deleting the line afterwards does not help

The token is staged, then removed from the working-tree copy. nosecrets reads the staged blob from the Git index, so it still reports what the commit would contain.

Deleting the line afterwards does not help

site/captures/usecases/staged-snapshot/

# config.py
API_URL = "https://api.acme.example"
GITHUB_TOKEN = "ghp_R2kT9xLm4Qv7Bn3Zc8Wd5Hf1Jg6Ys0AaPeXq"

$ git add config.py
$ sed -i.bak '/GITHUB_TOKEN/d' config.py && rm config.py.bak
$ cat config.py
API_URL = "https://api.acme.example"
$ nosecrets scan --staged
config.py:2:17 [CRITICAL] GitHub Personal Access Token (github-pat) nsi_5e31772c2cb9
  preview: ghp_...PeXq

scan --staged
git index