Catch the API key before it reaches the remote. Sentinel runs as a pre-commit hook and a CI check, understands 180 credential formats, and has never once blocked a build on a false positive in our test corpus.