Audit Repo Secrets and CI

Find what an attacker can reach in a repository the user owns: secrets in the tree and history, CI workflows that hand secrets or write tokens to untrusted code, and code bugs from input to sink. Prove each one locally, without touching systems the user does not own. The rules below are the mistakes agents make in security reviews.

Rules