Dotfiles Audit

Audit the repository in security-first order. The repository uses one GNU Stow package at ~/.dotfiles/home/; its README.md and dotfiles --help are authoritative for current layout and commands.

Step 0: Security scan

Search tracked files without printing credential values:

cd ~/.dotfiles

scan_redacted() {
  local detector=$1 pattern=$2
  git grep -nI -E "$pattern" -- ':(exclude)*.example' ':(exclude)*.md' 2>/dev/null |
    while IFS=: read -r file line _; do
      printf '%s:%s [%s; value redacted]\n' "$file" "$line" "$detector"
    done
}