SHU-0002 — Establish public-repository hygiene and secret containment

[BAWES]

SHU-0002 — Establish public-repository hygiene and secret containment

Control

• Repository: both new repositories
• Base SHA: ab4dc16c667fb1146a3ae99a9df2b946020e3be9 / 02a630441ed343ffdc1a874935763cacf27d8370
• Phase/domain/lane/risk: P0 / security / write / R2
• Implementer/verifier: <different model families>
• Human approver: Khalid
• Depends on: SHU-0001; blocks: all source/import/infra work

Outcome

The public repositories reject secrets, production data, private keys, internal endpoints and unsafe artifacts before merge.

Inputs and authority

• Allowed: .gitignore, .gitattributes, public security policy, contribution guide, CI scanners, fixture policy
• Forbidden: testing scanners with real credentials/PII; committing the production dump

Acceptance tests

1. Synthetic secret, private key, dump filename, .env, SQL archive and prohibited endpoint fixture each fail the expected check.
2. Approved synthetic fixtures and documented public URLs pass.
3. Fork PR workflow has read-only permissions and no secret-dependent steps.
4. Binary/build artifacts and files over the policy threshold fail unless allowlisted.

Deliverables

Secret/data policy, scanner configuration, .gitignore, SECURITY.md, public disclosure guidance and evidence manifest.

Non-goals

Legal/compliance program or scanning production systems.

Stop and escalate

Scanner requires uploading repository content or secrets to an unapproved third party.

Handoff

Final SHA, positive/negative scanner receipts and residual false-positive list.