LlamaCasty/TASKS/task-56-secret-scan.md

TASK 56 — Pre-publication secret scan of the full git history (queued 2026-10-09)

Catalog: TASKS.md — status and requirements live here.

Why: the creator is switching the Gitea repo (https://llgit.llamachile.tube/gramps/LlamaCasty) to public (GPL-3.0-or-later release). The working tree is clean — CREDENTIALS.md, MARCOM.md, and Helpers/OAuthCredentials.cs are gitignored and were never committed — but every past commit becomes readable too. Anything ever committed by mistake would be exposed.

Gate: do this BEFORE the repo is toggled public.

Slices:

1. ☐ Scan every commit, every branch for secret-shaped content: Google OAuth client secrets (GOCSPX-), API keys / tokens (Polar OAT, ghp_, AKIA, private-key headers), passwords, stream keys, and any once-tracked CREDENTIALS.md / OAuthCredentials.cs. ⛔ Report commit + path + rule only — never print a matched value (see MyMistakes.md → "NEVER PRINT CREDENTIALS.md"). A tool like gitleaks with --redact, or git log -p piped to a counter, never to the screen.
2. ☐ If anything is found: rotate that secret first (it's burned regardless), then decide with the creator: rewrite history (git filter-repo) vs. accept the rotated value staying in history.
3. ☐ Record the result (clean / what was rotated) here and in HANDOFF.md, then the creator flips the repo public.