Security Preflight

One gate that runs the three scans in the order that matters and gives a single pass/triage verdict. The sibling of ship-preflight (which proves it works) — this proves it's safe to expose. Run it before a repo goes public and before any release tag. It is a gate, not a fix-all: it surfaces and blocks on the things that must not ship; remediation is the individual skills.

When to run

• Before a repo goes public (history becomes world-readable — the irreversible moment).
• Before any release tag (the audited artifact).
• Before a force-push or history rewrite (you're about to make the old state canonical or gone).

The gate (run in order, stop on a hard-fail)

# 1. SECRETS — hard gate. A live secret in history blocks everything.
gitleaks detect --no-banner --redact
git ls-files | grep -iE '(^|/)\.env$|\.pem$|id_rsa|credentials|api-token|\.key$'   # tracked-file check