# TASK 56 — Pre-publication secret scan of the full git history (queued 2026-10-09)

> Catalog: [`TASKS.md`](../TASKS.md) — status and requirements live here.

**Why:** the creator is switching the Gitea repo (`https://llgit.llamachile.tube/gramps/LlamaCasty`)
to **public** (GPL-3.0-or-later release). The working tree is clean — `CREDENTIALS.md`,
`MARCOM.md`, and `Helpers/OAuthCredentials.cs` are gitignored and were never committed — but every
past commit becomes readable too. Anything ever committed by mistake would be exposed.

**Gate:** do this BEFORE the repo is toggled public.

**Slices:**

1. ☐ **Scan every commit, every branch** for secret-shaped content: Google OAuth client secrets
   (`GOCSPX-`), API keys / tokens (Polar OAT, `ghp_`, `AKIA`, private-key headers), passwords,
   stream keys, and any once-tracked `CREDENTIALS.md` / `OAuthCredentials.cs`.
   ⛔ **Report commit + path + rule only — never print a matched value** (see `MyMistakes.md` →
   "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with `--redact`, or `git log -p` piped to a
   counter, never to the screen.
2. ☐ **If anything is found:** rotate that secret first (it's burned regardless), then decide with
   the creator: rewrite history (`git filter-repo`) vs. accept the rotated value staying in history.
3. ☐ Record the result (clean / what was rotated) here and in `HANDOFF.md`, then the creator flips
   the repo public.