git grep -E silently ignores \b word boundaries; use -w

A scan like git grep -niE "\bfoo\b" returns zero matches even when foo appears as a whole word. git grep's ERE is POSIX, where \b doesn't mean a word boundary, and there's no error, so a secret or privacy scan built on it looks clean. Use git grep -niw foo for whole-word matches, or -P if git was built with PCRE. Second trap: in a sparse checkout, plain git grep only searches checked-out paths, so scan the whole tree with git grep ... HEAD -- ..