Docs: queue TASK 56 — pre-publication secret scan of the full git history (gate before the repo goes public) (Unit: task catalog)

TASKS.md

@@ -71,6 +71,7 @@
 | 53 | **Output-format verification: Shorts/TikTok geometry (9:16)** | ☐ Queued (2026-10-08) — output formats never tested end-to-end; pin + prove the vertical geometry | [`TASKS/task-53-output-formats.md`](TASKS/task-53-output-formats.md) |
 | 54 | **Marcom round: free-forever positioning + merch storefront** | 🔶 In progress — llamacasty.com copy live 2026-10-08 (pricing stripped); merch POD + app About links queued | [`TASKS/task-54-marcom-free-merch.md`](TASKS/task-54-marcom-free-merch.md) |
 | 55 | **Disk hygiene: log rotation + low-disk guard** | ☐ Queued (2026-10-09) — `startup.log` appears uncapped; also temp alert-clip cleanup + free-space check before recording | [`TASKS/task-55-disk-hygiene.md`](TASKS/task-55-disk-hygiene.md) |
+| 56 | **Pre-publication secret scan (full git history)** | ☐ Queued (2026-10-09) — gate before the Gitea repo goes public; report commit/path only, never values | [`TASKS/task-56-secret-scan.md`](TASKS/task-56-secret-scan.md) |
 
 ---
 

TASKS/task-56-secret-scan.md

@@ -0,0 +1,23 @@
+# TASK 56 — Pre-publication secret scan of the full git history (queued 2026-10-09)
+
+> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.
+
+**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
+to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
+`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
+past commit becomes readable too. Anything ever committed by mistake would be exposed.
+
+**Gate:** do this BEFORE the repo is toggled public.
+
+**Slices:**
+
+1. ☐ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
+   (`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
+   stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
+   ⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
+   "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
+   counter, never to the screen.
+2. ☐ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
+   the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
+3. ☐ Record the result (clean / what was rotated) here and in `HANDOFF.md`, then the creator flips
+   the repo public.