gatekeeperlisted

# Gatekeeper scan ## Why this exists Going public is one way: once a secret or a private name is in public git history, deleting it later does not unpublish it. This skill is the sweep you run before that step. ## Run the scan `scripts/scan.mjs` is a zero-dependency Node scanner. It reads the repo's git-tracked files (or, outside a git repo, walks the directory) and reports findings by severity. ``` node scripts/scan.mjs /path/to/repo ``` Add `--json` for machine-readable output. The exit code is `1` if there is any blocking finding (critical or high), otherwise `0`. ## Configure project-specific terms The universal patterns (keys, tokens, paths) are built in. For terms specific to you, add a `.publicrelease.json` at the repo root: ```json { "allowedIdentities": ["my-repo", "your-public-handle"], "denyTerms": ["acme-internal", "corp-codename"] } ``` - `denyTerms` are treated as critical leaks. Put your work email domain and your private project codenames here. - `allowedIdentities` suppress findings that are meant to be public, like the repo's own name or a public contact. - `ignoreGlobs` (optional) skip paths whose name contains the glob, for files that legitimately hold pattern-like text. ## Read the findings - **critical** and **high** block: keys, private keys, credentialed connection strings, local paths, security TODOs, and configured deny terms. Fix these before publishing. - **medium** and **info** are for review: phone numbers and generic emails. Conf