Refuse a commit that adds something shaped like a credential

The companion to the fixture removal. A site-admin token sat in a test file for
92 commits and fourteen days on a public mirror, past five audit rounds and two
independent reviews, because all of them read the code under change and this was
not under change. A grep would have caught it the first day.

`scripts/scan-secrets.sh` is that grep, in three rules:

  * vendor-prefixed credentials — `ghp_`, `github_pat_`, `glpat-`, `xox*-`,
    `sk-`, `AKIA`/`ASIA`, `ya29.`, `AIza`, `npm_`, `dckr_pat_`. Shape alone
    identifies these, so there is no context to get wrong.
  * `BEGIN … PRIVATE KEY` blocks.
  * an opaque literal assigned to a secret-shaped name — the rule that would
    have caught this one.

The third rule needs **both** halves, and that is what makes it usable rather
than another disabled check. Measured before writing it: an entropy-only rule
flags 317 literals in this tree, and name-proximity alone flags four, three of
which are `secure::get_project_secret(&id, "aws-secret-access-key")` — a
keychain *key name* sitting next to the word `secret`. Requiring the literal
itself to be hex or base64 with no word structure is what excludes those.

Validated rather than asserted:

  * **0 false positives** across every tracked file.
  * **Catches the real incident** — `--range 9b2f4fe~1..9b2f4fe` is refused.
  * Twelve shaped cases pass and fail as intended, including a sha256 in an
    `assert_eq!`, a git sha in a comment and the new dummy fixture, none of
    which trip it.
  * The hook was proved to block an actual `git commit`, not just to exist.

Two halves, because each covers the other's gap:

  * `.githooks/pre-commit`, enabled per clone by `npm run hooks`. Git will not
    let a repository set its own hooks path — cloning would then be enough to
    run its code — so this is opt-in everywhere and `--no-verify` skips it.
  * `Secret Scan`, which nobody can bypass. It carries **no `paths:` filter** on
    purpose: the leak lived in `app/**` and `build.yml` only runs for
    `container/**`, so a path-filtered scan would have missed the very thing it
    exists for. It scans the whole tracked tree rather than a range, because a
    wrong range fails *open* and the full pass takes 0.5s.

Also fixed while here: `core.hooksPath` in this clone pointed at
`/workspace/.git/hooks`, a directory that does not exist — so git hooks were
disabled outright and anything dropped in `.git/hooks` would have been ignored
in silence. A hook that never runs is worse than no hook, because the checklist
says it is there.

`--tracked` skips binaries. Feeding a blob to grep gets "binary file matches"
instead of the line, so a genuine finding inside one would arrive as a sentence
nobody can act on.

A line ending `pragma: allowlist secret` is skipped — wordy on purpose, so it
reads as a claim and leaves something greppable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LHL9ty7arp8FHwvE77ne7y

CLAUDE.md

@@ -525,6 +525,33 @@ Anthropic and Bedrock deliberately keep Claude Code's own defaults.
   `models/project.rs` for anything that should default to true.
 - Cross-platform paths: Docker socket is `/var/run/docker.sock` on Linux/macOS, `//./pipe/docker_engine` on Windows
 
+## Secrets
+
+**`scripts/scan-secrets.sh` refuses a commit that adds something shaped like a live
+credential.** Enable the hook once per clone with `npm run hooks` (from `app/`), which sets
+`core.hooksPath` to `.githooks`. A repository cannot configure its own hooks path — cloning it
+would then be enough to run its code — so this is opt-in everywhere, and `--no-verify` skips it.
+The `Secret Scan` workflow is the half nobody can bypass; it carries **no `paths:` filter**, on
+purpose, because the incident that prompted all this lived in `app/**` and `build.yml` only runs
+for `container/**`.
+
+Three rules, and the second half of the third is what keeps it usable: vendor-prefixed tokens
+(`ghp_`, `sk-`, `AKIA`, `xox`, …), `BEGIN … PRIVATE KEY` blocks, and an opaque literal assigned to
+a secret-shaped name. That last one needs **both** halves — the identifier must read as a
+credential *and* the whole literal must be hex or base64 with no word structure. Name-proximity
+alone flags `secure::get_project_secret(&id, "aws-secret-access-key")`, which is a keychain key
+name; the literal test is what excludes it. Measured against the tree: 0 false positives, and it
+catches the real incident (`9b2f4fe`) when replayed.
+
+A line ending `pragma: allowlist secret` is skipped. Make a fixture obviously fake before reaching
+for it.
+
+**Why this exists:** `the_custom_env_fingerprint_never_carries_the_value` used the maintainer's
+real Gitea **site-admin** token as its fixture — a test about secrets not escaping, leaking one. It
+survived 92 commits and fourteen days in the public GitHub mirror, past five audit rounds and two
+independent reviews, because every one of them read the code under change and this sat in a test
+nobody had reason to open. Fixtures are never live values; there is no case where they need to be.
+
 ## Testing
 
 Frontend tests use Vitest with jsdom environment and React Testing Library. Setup file at `src/test/setup.ts`. Run a single test file: