setup-gitleaks

This is a repository sanitization and credential-scanning script, not an evident credential stealer or destructive payload. It contains a code-injection risk because untrusted filenames are interpolated into Python source and executed when gitleaks returns a nonzero result; the report path is also interpolated unsafely. Treat as a security warning and replace the dynamic Python construction with safely passed arguments or data serialization; additionally, missing gitleaks/config can cause the credential layer to be skipped while the result remains CLEAN.