Comment by ctippett

Tools like TruffleHog[1] will attempt to verify any credentials it finds by making some sort of authenticated request.

[1] https://github.com/trufflesecurity/trufflehog#validation-