diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..944aa57
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,4 @@
+# Copy to .env and adjust; do not commit .env with real values.
+# Optional: set to 1, true, yes, or on to auto-enable the Django integration at import
+# (see xa_transactions.integrations.django).
+# XA_ENABLE_DJANGO_INTEGRATION=
diff --git a/.gitignore b/.gitignore
index 4dca150..4046ebb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,3 +47,14 @@ dmypy.json
 # Project specific
 *.db
 *.sqlite
+
+# Secrets and local env (never commit real values)
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+id_rsa
+id_rsa.pub
+*.p12
+*.pfx
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 450afa5..9ea046a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,6 +2,11 @@
 # Run manually: pre-commit run --all-files
 
 repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.9.9
     hooks: