declassifylisted

# Declassify The repo is going public. Everything ever committed — every branch, every old revision — becomes readable by everyone, forever, the moment the switch flips. Your job is to find what shouldn't ship, fix what can be fixed, and deliver an honest go/no-go. ## The prime law **A secret that ever touched git history is compromised, full stop.** Rewriting history does not un-leak it (clones, forks, and caches exist). Every found credential gets *rotated*; history rewriting is optional hygiene on top, never the remedy. Say this clearly in the report every time. ## Phase 1 — Secrets sweep Sweep the working tree **and the full history** (`git log -p --all`, every branch and tag): - Known token shapes: cloud provider keys, API tokens (`ghp_`, `sk-`, `AKIA…`, etc.), private key blocks, connection strings with embedded passwords, webhook URLs. - High-entropy strings in config-shaped places; `.env`-style files ever committed, even if since deleted. - Secrets hiding outside code: CI configs, docker-compose files, test fixtures, notebook outputs, lockfile registry URLs with tokens. For each hit: what it is, which commits contain it, whether it's plausibly still live, and the rotation action. Use dedicated scanners if available (`gitleaks`, `trufflehog`); do a manual pattern pass regardless — tools miss context-dependent secrets like internal URLs. ## Phase 2 — People and places Things that aren't credentials but shouldn't ship: personal emails and real names beyond what