The most common way secrets leak
Not a breach. An engineer debugging a deployment pastes a config file, an environment dump or a stack trace into a model to ask what is wrong, and the credentials go with it.
It is mundane, it happens constantly, and it is entirely preventable by checking first. That is the whole purpose of this page.
If something has already been sent
Rotate it. Immediately, and without debating how likely exposure is.
A credential that has left your machine should be treated as compromised: it is in request logs, possibly retained for abuse monitoring, and possibly in your own application logs and error tracker as well. Rotation is cheap. The alternative is not.
What it detects
Structured credential formats with recognisable prefixes or shapes — provider API keys, GitHub and Slack tokens, AWS access key identifiers, private key blocks, JWTs and credentials embedded in connection URLs.
It will not catch a bare random string with no distinguishing structure, because nothing distinguishes it from any other random string. If secrets routinely pass through your prompts, the fix is architectural rather than a regular expression.