u/Chris__Codes

I always assumed deleting a key from a file was enough but from what I’ve learned that’s not how git works

Pre-commit hooks and CI only look at the diff. So if a key gets committed and you delete it in the next commit, every check turns out OK from then on, but the value is still sitting in history and still valid. The recommendation is to scan full history on a schedule and treat anything you find as exposed, and rotate it, even though it's long gone from the current files.

So the scan is really just telling you a leak already happened, and rotation is the part that actually contains it.

I have side projects from years ago where I don't remember what was committed before I knew better. Some of those keys are probably still valid.

Do you run scheduled history scans, or just pre-commit and CI? And when something surfaces from years back, do you rotate it or make a call based on whether the repo was ever public?

Most of my day-to-day is spent working with React and TypeScript, but I have been picking up Python recently to get into data pipelines. I read a tutorial about building a price monitoring agent, and it covered some failure points that happen when targeting heavily protected sites like Amazon or Walmart.

Two specific quiet failures that will break these pipelines in production without immediately throwing obvious errors were pointed out:

1. Retrieval failure, where your script sends a request and does not crash, so you think it worked, but in reality, the target site served a blank JavaScript shell, an error 1020, or a Cloudflare block instead of the actual HTML product page.
2. Extraction failure where you successfully get the data to the LLM, and it finds the price. But across different runs, the LLM changes the data type, returning a float one time and a string in the next run. And this data drift can quietly break your downstream database writes.

For those of you writing Python scraping scripts in production, how are you handling that extraction data validation? Do you rely heavily on structural schema parsing libraries to keep your LLM outputs strictly typed, or do you have a different setup?