Gitleaks searches the working tree and every commit in history for credentials. The history part is what matters: removing a key in a later commit does not remove it from the repository, and anyone who cloned before the fix still has it.
A hit is not just a finding, it is an incident — the credential must be rotated, not deleted. Running it as a pre-commit hook is the cheaper posture, since it stops the secret before it becomes history.