From 21e63089b98c13b7a8d9f86e521ff84fd6ad344f Mon Sep 17 00:00:00 2001
From: Kemal Yaylali <kemal.yaylali@gmail.com>
Date: Wed, 30 Sep 2026 08:37:18 +0100
Subject: [PATCH] Guard against committed credentials: ignore secret files,
 secret scan in CI

---
 .github/workflows/ci.yml |  5 +++++
 .gitignore               | 10 ++++++++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7195b4f..bd59006 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,6 +15,11 @@ jobs:
       - uses: astral-sh/setup-uv@v5
         with:
           python-version: ${{ matrix.python }}
+      - name: Secret scan (no cloud keys or private keys in the repository)
+        run: |
+          if git grep -nIE '(AKIA|ASIA)[A-Z0-9]{16}|aws_secret_access_key *=|BEGIN [A-Z ]*PRIVATE KEY'; then
+            echo "::error::credential-like content found"; exit 1
+          fi
       - name: Install
         # setup-uv >= 5.x already creates and activates .venv when python-version is set; --clear works either way
         run: uv venv --clear && uv pip install -e ".[dev]"
diff --git a/.gitignore b/.gitignore
index cc5051d..7bb3b6a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -20,3 +20,13 @@ target/
 results/
 # editor lock files
 .~lock.*#
+# credentials and secrets (never commit)
+.aws/
+.env
+.env.*
+*.pem
+*.key
+*.p12
+credentials
+.git-credentials
+.netrc