# Secrets Detection

## Role
Verify no secrets or credentials are present in source code.

## Actions
1. Install gitleaks if missing:
   ```bash
   # or use npx @secretlint/secretlint
   ```
2. Scan repository:
   ```bash
   npx @secretlint/secretlint "**/*"
   ```
3. Check sensitive files:
   - .env (must not be committed)
   - Configuration files
   - Templates
4. Verify .gitignore includes sensitive files
5. Scan git history if needed

## Validation Criteria
- [ ] No secrets detected in src/
- [ ] .env in .gitignore
- [ ] No hardcoded tokens/API keys
- [ ] Clean git history