flan
6ccff1c8df
secret-scan / gitleaks (push) Successful in 11s
Scans the full git history on push, pull request and weekly, so a credential that was committed and later removed is still detected. The scanner archive is pinned by version and verified by SHA-256 before it runs, and matched values are redacted so they never reach the CI log. The accompanying allowlist covers two redaction test fixtures that assert secret-shaped input is masked. Each entry is pinned to an exact commit, file, rule and line, so a real secret added to those files later is still reported.