leak-checklisted

# Leak Check Scan what is about to leave your machine — the staged diff, or the text you're about to paste somewhere public. Two categories, different remedies. ## 1. Secrets Grep the diff for: `api[_-]?key`, `secret`, `token`, `password`, `passwd`, `credential`, `BEGIN [A-Z ]*PRIVATE KEY`, `AKIA[0-9A-Z]{16}`, `ghp_`, `sk-`, `Bearer `, connection strings (`://user:pass@host`), and long base64/hex blobs. For each hit, decide: real secret or placeholder? 1. **Real secrets move to env or a secrets manager** — never the repo. Reference them by variable name. 2. **Already committed means COMPROMISED.** Rotate it. Deleting the line does not help — the value is in the history, on every clone, and in any fork or CI cache. Rotation is the fix; removing the line is cleanup. 3. **Add a pre-commit secret scanner** so the next one is caught mechanically, and put the file pattern in `.gitignore`. ## 2. Non-public context Quieter than secrets and just as hard to retract once published: - **PII** — real names, emails, phone numbers, customer or employee identifiers. - **Absolute and personal paths** — `/Users/<name>/…`, `~/projects/<repo>`. These also just break for everyone else. - **Internal infrastructure** — hostnames, private URLs, IPs, account/project IDs, ARNs, cluster names. - **Employer-specific names** — tables, buckets, datasets, services, teams, internal ticket IDs. - **Machine-local context** — env dumps, cloud/CLI config files, transcripts, raw logs.