Secrets checks should be in git as well because if you’re only checking in CI then your secret has already been published.