Secret detection scans commit history on default branch pushes

Secret detection on the default branch now scans all commit diffs in a push when a prior commit reference is available, rather than scanning only the latest directory contents. This change closes a gap where secrets introduced and removed within the same push went undetected. The behavior now aligns with how secret detection works on merge requests and feature branches.

This scanning catches secrets that briefly existed in your repository history even if removed before the pipeline completes. Security teams can now identify secrets that were ever committed, not just those present at HEAD.

For more information, see pipeline secret detection coverage.