security: lefthook + gitleaks secret gate (pre-commit, pre-push, CI); remove OSF token

.github/workflows/secret-scan.yml

@@ -105,3 +105,30 @@ jobs:
           # occurrence fails; a file that grows fails; a file that shrinks fails
           # too, so the slack cannot be banked.
           python3 tools/check_devhome_paths.py
+
+  # Server-side twin of the lefthook secret gate (lefthook.yml): the same
+  # gitleaks rules (.gitleaks.toml) over every commit the PR or push adds,
+  # so a commit made with --no-verify still cannot land a credential.
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Scan the commits this event adds
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          set -euo pipefail
+          if [ -n "${BASE:-}" ] && git cat-file -e "$BASE^{commit}" 2>/dev/null; then
+            RANGE="$BASE..HEAD"
+          else
+            RANGE="HEAD~1..HEAD"
+          fi
+          gitleaks git --no-banner --redact --config .gitleaks.toml --log-opts="$RANGE" .

.gitleaks.toml

@@ -0,0 +1,36 @@
+# Secret gate for gHashTag/t27 -- canonical copy of the shared rules.
+# Other gHashTag repos copy the [[rules]] block below; change it here first.
+#
+# Three layers, each catching what the one before missed:
+#   1. lefthook pre-commit  -> gitleaks scans staged changes (lefthook.yml)
+#   2. lefthook pre-push    -> gitleaks scans commits not yet on any remote
+#   3. CI secret-scan       -> gitleaks scans the PR range; cannot be skipped
+#                              with --no-verify (.github/workflows/secret-scan.yml)
+# Secrets belong in the environment or in gitignored files, never in the tree.
+
+[extend]
+useDefault = true
+
+# The default rules miss Wi-Fi passphrases and other plain passwords.
+[[rules]]
+id = "hardcoded-password-literal"
+description = "Hardcoded password/passphrase string literal (e.g. Wi-Fi credentials in firmware)"
+regex = '''(?i)\b[a-z_]*(passphrase|password|passwd|wifi_?pass|psk)[a-z_]*\b["']?\s*[:=]\s*["']([^"'<>${}\s]{6,})["']'''
+secretGroup = 2
+keywords = ["passphrase", "password", "passwd", "wifi", "psk"]
+[[rules.allowlists]]
+regexTarget = "match"
+regexes = ['''(?i)(your|example|changeme|placeholder|dummy|test|xxx|\*\*\*)''']
+
+[[allowlists]]
+description = "Verified non-secrets in t27: generated symbol inventory"
+paths = ['''conformance/trinity/inventory\.json''']
+
+[[allowlists]]
+description = "Verified non-secret lines: GF16 hex constant, prose, compiler flags"
+regexTarget = "line"
+regexes = [
+  '''hex_key = .*# fallback for GF16''',
+  '''pub const NOTE : str = "S07:''',
+  '''"-O", mode, "--dep"''',
+]

SECURITY.md

@@ -17,4 +17,17 @@ Include:
 - Steps to reproduce (if possible)
 - Affected components (e.g. `bootstrap/`, `tri` / `t27c serve`, CI)
 
-We will acknowledge receipt as capacity allows and coordinate a fix and disclosure timeline.
+We will acknowledge receipt as capacity allows and coordinate a fix and disclosure timeline.
+## Secrets never enter the repository
+
+No password, API key, token or credentials file is committed, not even in docs or examples. Read secrets from the environment or from a gitignored file.
+
+The gate has three layers, all driven by [`.gitleaks.toml`](.gitleaks.toml):
+
+1. **pre-commit** (lefthook) scans staged changes with gitleaks.
+2. **pre-push** (lefthook) scans every commit that is not yet on a remote.
+3. **CI** ([`secret-scan`](.github/workflows/secret-scan.yml)) scans the PR range, so `--no-verify` does not get a secret past it.
+
+Set up once per clone: `brew install gitleaks lefthook && lefthook install`.
+
+A secret that was ever pushed is compromised. Removing it from the tree does not unpublish it, so rotate it at the provider.

lefthook.yml

@@ -14,11 +14,15 @@
 # and 80 per diff. It reads no exception list; no label lifts it.
 # The CI twin is .github/workflows/own-language.yml.
 #
-# PR #6433 adds a `secret-gate` command to both hooks; merging the two files is
-# a union of the command lists.
+# secret-gate (#6433): requires gitleaks (`brew install gitleaks`). A missing
+# gitleaks fails the hook on purpose: the secret gate must not silently turn
+# itself off. Rules live in .gitleaks.toml; the CI twin is
+# .github/workflows/secret-scan.yml.
 
 pre-commit:
   commands:
+    secret-gate:
+      run: gitleaks git --staged --no-banner --redact --config .gitleaks.toml .
     own-language:
       env:
         OWN_LANGUAGE_DIFF: --cached
@@ -41,6 +45,8 @@ pre-commit:
 
 pre-push:
   commands:
+    secret-gate:
+      run: gitleaks git --no-banner --redact --config .gitleaks.toml --log-opts="HEAD --not --remotes" .
     own-language:
       env:
         OWN_LANGUAGE_DIFF: origin/master...HEAD

research/gamma-hypotheses/OSF-upload-summary.md

@@ -6,7 +6,7 @@
 **Node URL:** https://osf.io/tza56
 
 ## OAuth2 Token
-Token: `4hZA5K0iVwvJ1hN9fYqaFVJG375xsG94UTfVAKhm7ziWPRbbKccRhM1xl8Xj9nh2iK4RJ3`
+Token: not stored in the repository. Read it from the `OSF_TOKEN` environment variable.
 Status: ✅ Valid (API accepts token)
 
 ## API Status

tools/census/quiet.txt

@@ -2,7 +2,7 @@ GATE STEPS WHOSE PASS SURVIVES THE SUBJECT GOING MISSING
 
   workflow files read           67
   steps in a quiet shape        33
-  named a path but not quiet    233   (--excluded prints them)
+  named a path but not quiet    235   (--excluded prints them)
 
   by shape:
     failure branch passes       14   `… 2>/dev/null … || echo PASSED`

tools/census/shell.txt

@@ -1,11 +1,11 @@
 WHICH INTERPRETER EACH GATE STEP IS HANDED TO, AND WHO SAYS SO
 
   workflow files read           67
-  jobs                          93
-  run: steps                    325
+  jobs                          94
+  run: steps                    327
 
   who names the shell:
-    the runner does             304   no container, so bash -eo pipefail
+    the runner does             306   no container, so bash -eo pipefail
     a `shell:` key does         6
     NOBODY                      15   a container and no `shell:` key