It would be useful if it also trawled through the full git history of the project - a secret could have been checked in and later removed, but still exist in the history.