From 3b6f833d11b4b92ce023e9c876438687cfe65284 Mon Sep 17 00:00:00 2001
From: edgecasehuman <309310929+edgecasehuman@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:54:11 -0500
Subject: [PATCH] Harden repository secret and personal-data safeguards

---
 .github/workflows/audit.yml | 11 ++++++
 .gitignore                  | 75 ++++++++++++++++++++++++++++++++++++-
 .pre-commit-config.yaml     |  5 +++
 CONTRIBUTING.md             | 18 +++++++++
 4 files changed, 108 insertions(+), 1 deletion(-)
 create mode 100644 .pre-commit-config.yaml

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 57046c5..6cdfc02 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -33,6 +33,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
@@ -44,3 +46,12 @@ jobs:
       # because they are not always actionable from here.
       - name: Audit dependencies
         run: cargo audit
+
+      # Scan the complete history as well as the checkout. This remains in the
+      # required cargo-audit job so a secret blocks the existing branch gate.
+      - name: Scan git history for secrets
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
diff --git a/.gitignore b/.gitignore
index f7dbfad..c4e28dc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,9 +33,77 @@ baseline.json
 *.mp4
 *.zip
 
-# Local scratch, secrets, and machine-specific configuration.
+# Local scratch, secrets, and machine-specific configuration. These rules are a
+# first line of defense only; the staged secret scan in CI is the enforcement
+# layer.
 .env
 .env.*
+*.env
+*.env.*
+!.env.example
+!*.env.example
+.npmrc
+.pypirc
+.netrc
+.authinfo
+credentials/
+credentials.*
+secrets/
+secrets.*
+tokens/
+tokens.*
+private/
+personal/
+confidential/
+sensitive/
+exports/
+captures/
+evidence/
+artifacts/
+reports/
+*.secret
+*.secrets
+*.token
+*.token.*
+*.credentials
+token.txt
+tokens.txt
+secret.txt
+secrets.txt
+credentials.txt
+*.pem
+*.key
+*.keystore
+*.jks
+*.p12
+*.pfx
+*.kdbx
+*.asc
+*.gpg
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+.aws/
+.azure/
+.gcloud/
+.kube/
+.ssh/
+
+# Local data exports and browser/network captures can contain personal text,
+# cookies, authorization headers, or machine identifiers.
+*.sqlite
+*.sqlite3
+*.db
+*.db-*
+*.csv
+*.tsv
+*.jsonl
+*.ndjson
+*.har
+*.pcap
+*.pcapng
+*.trace
 *.local
 scratch/
 tmp/
@@ -62,3 +130,8 @@ desktop.ini
 *.orig
 *.rej
 *.rs.bk
+*.tmp
+*.temp
+dist/
+*.tgz
+*.tar.gz
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..cc8dbcb
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 4f9fdd5..35fa878 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -14,6 +14,24 @@ screenshot of the whole window.
 **Do not report security vulnerabilities as issues.** See
 [SECURITY.md](SECURITY.md) for the private channel.
 
+## Secret and personal-data checks
+
+The ignore file is deliberately conservative, but it is not a security
+boundary: `git add -f` can bypass it and a file that was committed once remains
+in history. Install the staged secret hook before making commits:
+
+```sh
+pre-commit install
+pre-commit run --all-files
+```
+
+Before committing, inspect `git diff --cached --name-status` and the staged
+diff. Never commit real machine inventories, event logs, screenshots, browser
+exports, cookies, tokens, credentials, or other personal data. Use synthetic
+fixtures when a test needs an example value. CI repeats the Gitleaks history
+scan, so a finding must be removed and rotated rather than hidden with an
+ignore rule.
+
 ## Building
 
 Requires rustup and the Visual Studio Build Tools (`build.rs` invokes the