[v2.5.0]
- Behavior change:
scan --branch <ref>now scans all reachable history by default, finding secrets deleted in later commits, including merged history. Use--git-history noneto retain snapshot-only scanning; explicit diff options keep their existing scope. Full-history scans may need more time and memory, and history enumeration shares the repository’s--git-repo-timeoutbudget. #503