I'd say an alternative question is "how can we stop storing secrets in source control" so then tools like Trufflehog can't find them :)