Enforce safe handling of API keys, tokens, passwords, and credentials — env files, `.gitignore` coverage, `.env.example` upkeep, rotation after exposure. This is the PREVENTIVE workflow; `secrets-scan` is the detection pass that finds what already leaked. Run when adding an integration, before commi
Enforce safe handling of API keys, tokens, passwords, and credentials — env files, `.gitignore` coverage, `.env.example` upkeep, rotation after exposure. This is the PREVENTIVE workflow; `secrets-scan` is the detection pass that finds what already leaked. Run when adding an integration, before commits, before a first deploy, and when the user pastes something that looks like a credential or says "