secrets-scanlisted

# secrets-scan Catch secrets before they land in git. Enforces the non-negotiable: `.env`, credentials, tokens, API keys — never in git, never in fixtures, never in a commit message. **Read-only** — it never writes; it blocks by reporting. ## Scan (prefer a real scanner, else patterns) 1. **gitleaks** (preferred) — if installed: - staged / pre-commit: `gitleaks protect --staged --no-banner -v` - whole tree/history: `gitleaks detect --no-banner -v` If gitleaks isn't installed, say so and use the fallback. 2. **Pattern fallback** — over `git diff --cached` (staged) or the target diff. Redact the matched value in output. High-signal markers: - Provider keys: `sk-[A-Za-z0-9]{16,}`, `ghp_[A-Za-z0-9]{20,}`, `github_pat_`, `glpat-[A-Za-z0-9_-]{20,}`, `AKIA[0-9A-Z]{16}`, `AIza[0-9A-Za-z_-]{20,}`, `xox[baprs]-`, `sk-ant-` - Private keys: `-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----` - Generic assignments: `(api[_-]?key|secret|token|password|passwd|bearer|auth)` followed by `=`/`:` and a 16+ char value 3. **`.env` guard** — flag any real `.env` (not `.env.example`) being added: `git diff --cached --name-only | grep -E '(^|/)\.env$'`. ## Report - End with `SECRETS SCAN: PASS` or `SECRETS SCAN: FAIL`. - On FAIL, list each hit as `file:line — <rule>` with the value **redacted** (never echo the secret). Tell the operator to remove it AND rotate — a secret committed to git is compromised even if later deleted. - Don't cry wolf on obvi