I wrote a tool that scans all the new commits to our Org for passwords/secrets.
Webhook > AWS API Gateway > Lambda
The Lambda uses the new(ish) Layers feature so it can use Git. I then use the truffleHog[0] library to scan for entropy/regexes inside the commit.
If something is detected, it posts to an SNS topic, which is currently subscribed to by another Lambda that posts an alert to my team and the Security team's Slack channel.
It then calls the GitHub API to make the repo private to limit the exposure.