Scan for API keys on PR

[Andrew-S-Rosen]

I saw some terrifying Twitter threads about people accidentally uploading credentials to their GitHub repo and it causing massive security/financial havoc.

Might it be worth adding https://github.com/marketplace/gitguardian to maggma since this is one of the packages where that might be done accidentally? I added it to my repos, and it took all of about 30 seconds to setup (you just hit install). It's free.

[rkingsbury]

Sounds like a good idea to me! It looks like it has to be activated by a GitHub org admin (which I am not). What do you think @munrojm? If you agree, can you enable?

[Andrew-S-Rosen]

Here's the Twitter thread btw if you're morbidly curious: https://twitter.com/georgemporter/status/1677378445658173442

[munrojm]

Looking at it closer, it might make sense to add it to the org instead of through my personal account as it has to go through github billing despite it being free for public repos.