Harden the repo

.env.example

@@ -0,0 +1,4 @@
+# Copy to .env and adjust; do not commit .env with real values.
+# Optional: set to 1, true, yes, or on to auto-enable the Django integration at import
+# (see xa_transactions.integrations.django).
+# XA_ENABLE_DJANGO_INTEGRATION=

.gitignore

@@ -47,3 +47,14 @@ dmypy.json
 # Project specific
 *.db
 *.sqlite
+
+# Secrets and local env (never commit real values)
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+id_rsa
+id_rsa.pub
+*.p12
+*.pfx

.pre-commit-config.yaml

@@ -2,6 +2,11 @@
 # Run manually: pre-commit run --all-files
 
 repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.9.9
     hooks: