security: lefthook + gitleaks secret gate; remove hardcoded credentials

.github/workflows/secret-scan.yml

@@ -0,0 +1,37 @@
+name: secret-scan
+
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  # Server-side twin of the lefthook secret gate (lefthook.yml): the same
+  # gitleaks rules (.gitleaks.toml) over every commit the PR or push adds,
+  # so a commit made with --no-verify still cannot land a credential.
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/
+
+      - name: Scan the commits this event adds
+        env:
+          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          set -euo pipefail
+          if [ -n "${BASE:-}" ] && git cat-file -e "$BASE^{commit}" 2>/dev/null; then
+            RANGE="$BASE..HEAD"
+          else
+            RANGE="HEAD~1..HEAD"
+          fi
+          gitleaks git --no-banner --redact --config .gitleaks.toml --log-opts="$RANGE" .

.gitignore

@@ -469,3 +469,8 @@ fpga-flash
 # Local credential files: never commit (values come from Railway/Infisical)
 .trinity/ralph/queue/.creds
 ralph/queue/.creds
+
+# Local credentials - never commit (2026-10-05 leak cleanup)
+secrets.h
+.creds
+**/.creds

README.md

@@ -1283,6 +1283,20 @@ Attribution for listed docs and packages is checked by [`src/tri/author_attribut
 
 ---
 
+## Secrets never enter the repository
+
+No password, API key, token or credentials file is committed, not even in docs or examples. Read secrets from the environment or from a gitignored file (firmware Wi-Fi credentials: copy `secrets.h.example` to the gitignored `secrets.h`).
+
+The gate has three layers, all driven by [`.gitleaks.toml`](.gitleaks.toml):
+
+1. **pre-commit** (lefthook) scans staged changes with gitleaks.
+2. **pre-push** (lefthook) scans every commit that is not yet on a remote.
+3. **CI** ([`secret-scan`](.github/workflows/secret-scan.yml)) scans the PR range, so `--no-verify` does not get a secret past it.
+
+Set up once per clone: `brew install gitleaks lefthook && git config core.hooksPath .githooks` (the tracked hooks in `.githooks` call lefthook; on a clone without `core.hooksPath`, `lefthook install` works too).
+
+A secret that was ever pushed is compromised. Removing it from the tree does not unpublish it, so rotate it at the provider.
+
 ## License
 
 MIT -- see [LICENSE](LICENSE)

deploy/trinity-nexus/canvas/src/main_gui.zig

@@ -40,7 +40,8 @@ pub fn main() !void {
     const wallet_path = try config_mod.Config.getWalletPath(allocator);
     defer allocator.free(wallet_path);
 
-    const password = "trinity123"; // DEFERRED (v12): prompt for password
+    // Wallet password comes from the environment, never from source.
+    const password = std.posix.getenv("TRINITY_WALLET_PASSWORD") orelse return error.MissingWalletPassword;
 
     var wallet = wallet_mod.Wallet.loadOrCreate(wallet_path, password) catch |err| {
         std.debug.print("Failed to load wallet: {}\n", .{err});

fpga/COMPLETE_CONNECTION_GUIDE.md

@@ -282,8 +282,8 @@ OK: LED blinking enabled
 #include <WebSocketsServer.h>
 
 // WiFi credentials
-const char* ssid = "Trinity-FPGA";
-const char* password = "trinity2026";
+const char* ssid = "your-ssid";          // keep real values in a gitignored secrets.h
+const char* password = "your-wifi-password";
 
 WebServer server(80);
 WebSocketsServer webSocket = WebSocketsServer(81);

fpga/esp32_wifi_bridge/esp32_wifi_bridge.ino

@@ -32,8 +32,9 @@
 // ============================================================================
 
 // WiFi Access Point
-const char* AP_SSID = "Trinity-FPGA";
-const char* AP_PASSWORD = "trinity2026";
+// AP_SSID and AP_PASSWORD live in secrets.h, which is gitignored.
+// Copy secrets.h.example to secrets.h and fill it in before flashing.
+#include "secrets.h"
 
 // mDNS hostname
 const char* HOSTNAME = "trinity";

fpga/esp32_wifi_bridge/secrets.h.example

@@ -0,0 +1,4 @@
+// Copy to secrets.h (gitignored) and fill in. Never commit secrets.h.
+#pragma once
+static const char* AP_SSID = "your-ap-ssid";
+static const char* AP_PASSWORD = "your-ap-password";

lefthook.yml

@@ -1,3 +1,8 @@
+# Git hooks for trinity. Install once per clone: `lefthook install`
+# Requires gitleaks (`brew install gitleaks`). A missing gitleaks fails the
+# hook on purpose: the secret gate must not silently turn itself off.
+# Rules live in .gitleaks.toml; the CI twin is .github/workflows/secret-scan.yml.
+
 commit-msg:
   commands:
     english-only:
@@ -10,6 +15,8 @@ commit-msg:
 
 pre-commit:
   commands:
+    secret-gate:
+      run: gitleaks git --staged --no-banner --redact --config .gitleaks.toml .
     queen-bilingual-contract:
       root: "apps/website/"
       run: npm run check:queen-languages
@@ -19,6 +26,8 @@ pre-commit:
 
 pre-push:
   commands:
+    secret-gate:
+      run: gitleaks git --no-banner --redact --config .gitleaks.toml --log-opts="HEAD --not --remotes" .
     branch-name:
       run: |
         branch=$(git rev-parse --abbrev-ref HEAD)

src/trinity_node/main_gui.zig

@@ -40,8 +40,8 @@ pub fn main() !void {
     const wallet_path = try config_mod.Config.getWalletPath(allocator);
     defer allocator.free(wallet_path);
 
-    // DEFERRED (v12): Prompt for password via stdin (readLine, hide input)
-    const password = "trinity123";
+    // Wallet password comes from the environment, never from source.
+    const password = std.posix.getenv("TRINITY_WALLET_PASSWORD") orelse return error.MissingWalletPassword;
 
     var wallet = wallet_mod.Wallet.loadOrCreate(wallet_path, password) catch |err| {
         std.debug.print("Failed to load wallet: {}\n", .{err});

tools/telegram-bridge/2fa-neuro-sage.sh

@@ -6,4 +6,4 @@ echo "Verifying 2FA..."
 curl --max-time 30 -s -X POST "$BRIDGE/api/v1/auth/2fa" \
   -H "Content-Type: application/json" \
   -H "X-Session-ID: $SESSION" \
-  -d '{"password": "Vishnu8087"}'
+  -d "{\"password\": \"${TELEGRAM_2FA_PASSWORD:?set TELEGRAM_2FA_PASSWORD in the environment}\"}"