Add secret-scanning (gitleaks) to CI as a general safety net

[Marvell69]

Description
Beyond the narrow .env-specific guard in Issue 122, a general secret-scanning tool would catch other credential leak patterns (API keys pasted directly into code, Supabase service role keys, Resend API keys) across the entire diff on every PR — a meaningful gap for a project actively integrating multiple third-party services with real credentials.

Requirements and context

• Add gitleaks (or equivalent) as a CI workflow scanning every PR's diff
• Run an initial full-history scan to confirm no secrets are already present in git history; if found, treat as a security incident requiring credential rotation, not just a code fix
• Configure to fail the PR check on any finding

Suggested execution

git checkout -b ci/add-gitleaks-secret-scanning

• Add gitleaks CI workflow
• Run initial full-history scan and report findings to maintainers immediately if anything is found
• Document the process

Example commit message
ci: add gitleaks secret scanning to CI pipeline

Guidelines

• If the initial full-history scan finds any real secret, stop and report directly to maintainers before proceeding — do not attempt remediation via a public PR, as that would itself disclose the finding

[canicefavour]

I can strengthen the project's security posture by integrating gitleaks into the CI pipeline to scan every pull request for credential leaks, documenting the workflow, and performing an initial full-history audit—escalating any genuine secret discoveries privately to maintainers rather than exposing them through a public remediation PR.

[PHADAR6]

@PHADAR6 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainer I would like to work on this issue, thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @PHADAR6 to this issue.

[mhikel66]

@mhikel66 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hello maintainer i would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @mhikel66 to this issue.

[Max-Owolabi]

@Max-Owolabi has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I am a software engineer and i have good knowledge in resolving issues like this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Max-Owolabi to this issue.

[Meme11030]

@Meme11030 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

hi maintainer i will like to work on this issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Meme11030 to this issue.

[drips-wave]

Congratulations, @mhikel66! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @mhikel66: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊