Sweeps check more than dependencies
Alongside vulnerable dependencies, a maintenance sweep now looks for committed secrets, insecure code and infrastructure misconfiguration, each found by its own scan.
A sweep answers four questions where it used to answer one: which dependencies carry a known advisory, which credentials are committed to the repository, which code patterns a security reviewer would flag on sight, and which infrastructure exposes or under-protects something.
If one scan fails the others still report, and that scan's earlier findings are left as they were rather than marked fixed.
Findings group by package or by rule, and a group is remediated as one.
For a committed secret, Taiga does half the job and says so. It takes the credential out of the tracked source and moves the application onto a configured value. It cannot make the exposed one safe, because the value is in your history and stays valid until somebody revokes it, so the pull request says it still needs rotating. The value is never stored: the finding names the rule, the file and the line.