How GitHub used secret scanning to reach inbox zero — Blankdot