Skip to content

SEC-04: add secret scanning safeguards - #33

Merged
dspury merged 1 commit into
mainfrom
sec04/secret-guardrail
Jul 15, 2026
Merged

SEC-04: add secret scanning safeguards#33
dspury merged 1 commit into
mainfrom
sec04/secret-guardrail

Conversation

@dspury

@dspury dspury commented Jul 15, 2026

Copy link
Copy Markdown
Owner

Summary

  • add Gitleaks staged, working-tree, and full-history scan modes
  • add a versioned pre-commit hook and checksum-verified, read-only CI workflow
  • document secret response and pre-publication review rules

Validation

  • bash -n scripts/secret-scan.sh
  • Actionlint 1.7.12
  • Gitleaks 8.30.1 current tree and --all history: no findings
  • disposable synthetic credential fixture: detected with exit 1

Boundary

Source-only safeguard. No credential, runtime service, repository visibility, or protected branch was changed. Merge remains with the repository owner.

@dspury
dspury merged commit da3ad06 into main Jul 15, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant