Developer finds CI security scan version mismatch, exposing detection gaps

A developer integrated three security scans into a GitHub Actions pipeline and initially received clean results. They then tested the secret detection tool, gitleaks, with fabricated AWS keys to verify its accuracy. The tests revealed that the CI was silently running an outdated version of gitleaks due to an unpinned version in the action. This meant the pipeline had missed over a year of rule updates for detecting new token formats. The developer fixed the issue by explicitly pinning the tool version and adding branch protection rules.