How deep do you go when looking for secrets in CI/CD Pipelines?

That's the question.

Lupin discusses how devs are exposing orgs via insecure private CI/CD pipelines using their own npm tokens.