Harden repository secret and personal-data safeguards

.github/workflows/audit.yml

@@ -33,6 +33,8 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
 
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
 
@@ -44,3 +46,12 @@ jobs:
       # because they are not always actionable from here.
       - name: Audit dependencies
         run: cargo audit
+
+      # Scan the complete history as well as the checkout. This remains in the
+      # required cargo-audit job so a secret blocks the existing branch gate.
+      - name: Scan git history for secrets
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false"
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"

.gitignore

@@ -33,9 +33,77 @@ baseline.json
 *.mp4
 *.zip
 
-# Local scratch, secrets, and machine-specific configuration.
+# Local scratch, secrets, and machine-specific configuration. These rules are a
+# first line of defense only; the staged secret scan in CI is the enforcement
+# layer.
 .env
 .env.*
+*.env
+*.env.*
+!.env.example
+!*.env.example
+.npmrc
+.pypirc
+.netrc
+.authinfo
+credentials/
+credentials.*
+secrets/
+secrets.*
+tokens/
+tokens.*
+private/
+personal/
+confidential/
+sensitive/
+exports/
+captures/
+evidence/
+artifacts/
+reports/
+*.secret
+*.secrets
+*.token
+*.token.*
+*.credentials
+token.txt
+tokens.txt
+secret.txt
+secrets.txt
+credentials.txt
+*.pem
+*.key
+*.keystore
+*.jks
+*.p12
+*.pfx
+*.kdbx
+*.asc
+*.gpg
+id_rsa
+id_rsa.*
+id_ed25519
+id_ed25519.*
+.aws/
+.azure/
+.gcloud/
+.kube/
+.ssh/
+
+# Local data exports and browser/network captures can contain personal text,
+# cookies, authorization headers, or machine identifiers.
+*.sqlite
+*.sqlite3
+*.db
+*.db-*
+*.csv
+*.tsv
+*.jsonl
+*.ndjson
+*.har
+*.pcap
+*.pcapng
+*.trace
 *.local
 scratch/
 tmp/
@@ -62,3 +130,8 @@ desktop.ini
 *.orig
 *.rej
 *.rs.bk
+*.tmp
+*.temp
+dist/
+*.tgz
+*.tar.gz

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks

CONTRIBUTING.md

@@ -14,6 +14,24 @@ screenshot of the whole window.
 **Do not report security vulnerabilities as issues.** See
 [SECURITY.md](SECURITY.md) for the private channel.
 
+## Secret and personal-data checks
+
+The ignore file is deliberately conservative, but it is not a security
+boundary: `git add -f` can bypass it and a file that was committed once remains
+in history. Install the staged secret hook before making commits:
+
+```sh
+pre-commit install
+pre-commit run --all-files
+```
+
+Before committing, inspect `git diff --cached --name-status` and the staged
+diff. Never commit real machine inventories, event logs, screenshots, browser
+exports, cookies, tokens, credentials, or other personal data. Use synthetic
+fixtures when a test needs an example value. CI repeats the Gitleaks history
+scan, so a finding must be removed and rotated rather than hidden with an
+ignore rule.
+
 ## Building
 
 Requires rustup and the Visual Studio Build Tools (`build.rs` invokes the