Harden repository secret and personal-data safeguards

.github/workflows/audit.yml

@@ -33,6 +33,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
@@ -44,3 +46,12 @@ jobs:
       # because they are not always actionable from here.
       - name: Audit dependencies
         run: cargo audit
+
+      # Scan the complete history as well as the checkout. This remains in the
+      # required cargo-audit job so a secret blocks the existing branch gate.
+      - name: Scan git history for secrets
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"

.gitignore

@@ -10,13 +10,80 @@ npm/dist/
 /npm/droidsight/LICENSE
 node_modules/
 
-# Secrets and local environment. Never commit these.
+# Secrets and local environment. Never commit these. These rules are a first
+# line of defense only; the staged secret scan in CI is the enforcement layer.
 .env
 .env.*
+*.env
+*.env.*
+!.env.example
+!*.env.example
+.npmrc
+.pypirc
+.netrc
+.authinfo
+credentials/
+credentials.*
+secrets/
+secrets.*
+tokens/
+tokens.*
+private/
+personal/
+confidential/
+sensitive/
+exports/
+captures/
+evidence/
+artifacts/
+reports/
+*.secret
+*.secrets
+*.token
+*.token.*
+*.credentials
+token.txt
+tokens.txt
+secret.txt
+secrets.txt
+credentials.txt
 *.pem
 *.key
 *.keystore
 *.jks
+*.p12
+*.pfx
+*.kdbx
+*.asc
+*.gpg
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+.aws/
+.azure/
+.gcloud/
+.kube/
+.ssh/
+
+# Local data exports and browser/network captures can contain personal text,
+# cookies, authorization headers, or device identifiers.
+*.sqlite
+*.sqlite3
+*.db
+*.db-*
+state.json
+baseline.json
+*.csv
+*.tsv
+*.jsonl
+*.ndjson
+*.har
+*.pcap
+*.pcapng
+*.trace
+*.dmp
+*.etl
 
 # Coding-agent and editor working directories. These routinely contain absolute
 # local paths, transcripts, and machine names.
@@ -63,6 +130,10 @@ mcp_*.log
 *.dll
 *.so
 *.dylib
+*.tmp
+*.temp
+*.tgz
+*.tar.gz
 
 # Hardware-smoke transfer destination.
 .droidsight_probe_pull
@@ -76,3 +147,6 @@ local/
 *.local
 *.orig
 *.rej
+Thumbs.db
+desktop.ini
+.DS_Store

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks

CONTRIBUTING.md

@@ -49,6 +49,23 @@ of the defense:
   interpolated into it that did not come from this crate must be wrapped in
   `adb::shell_quote` first.
 
+## Secret and personal-data checks
+
+The ignore file is deliberately conservative, but it is not a security
+boundary: `git add -f` can bypass it and a file that was committed once remains
+in history. Install the staged secret hook before making commits:
+
+```sh
+pre-commit install
+pre-commit run --all-files
+```
+
+Before committing, inspect `git diff --cached --name-status` and the staged
+diff. Never commit real device captures, browser exports, cookies, tokens,
+credentials, personal logs, or unredacted screenshots. Use synthetic fixtures
+when a test needs an example value. CI repeats the Gitleaks history scan, so a
+finding must be removed and rotated rather than hidden with an ignore rule.
+
 ## Development checks
 
 The pinned compiler, formatter, and linter are declared in