How a database password ends up in git history, and why rotating it is not enough

The four ways a credential gets into a migration file, what happens to it after the commit, and why the fix is scanning the diff rather than hoping th