feat: Refuse commits that name something internal

This repository is public. A doc comment and a commit message had already put a
live resource name, an issue id and telemetry detail into it, none of which any
reader outside the team should see.

- A pre-commit and commit-msg hook scan added lines and the message for
  protected terms, email addresses and credential-shaped strings. Removals are
  ignored, so taking a leaked term out again is never blocked.
- The list of real names lives in .git/leak-terms.txt and is never committed. A
  deny-list of what you are hiding, published, hands over the whole list.
- A workflow runs the same script over every pushed commit, because a local
  hook is one --no-verify away from doing nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TExPjUDcSFMaH5cdgAmEvS

Author: malware-dev

.githooks/commit-msg

@@ -0,0 +1,4 @@
+#!/bin/sh
+# The message too. A commit message is as public as the diff and is far easier to write
+# carelessly, because nobody reviews it.
+"$(git rev-parse --show-toplevel)/.githooks/leak-scan.sh" < "$1" || exit 1

.githooks/leak-scan.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+# Refuses content that names things outside this repository: customer, employer or
+# infrastructure identifiers that have no business in a public history.
+#
+# Reads text on stdin. Exits non-zero and prints what matched.
+#
+# The list of real names lives in .git/leak-terms.txt, which is inside .git and therefore
+# never committed. That is deliberate: a deny-list of the words you are hiding, committed
+# to the repository, publishes exactly what it was meant to protect.
+
+terms_file="$(git rev-parse --git-dir)/leak-terms.txt"
+
+scan_input="$(mktemp)"
+cat > "$scan_input"
+trap 'rm -f "$scan_input"' EXIT
+
+# Literal matching is done in the shell rather than with "grep -qF", which aborts on some
+# Git for Windows builds and takes the whole check down with it, silently passing.
+lower="$(tr '[:upper:]' '[:lower:]' < "$scan_input")"
+
+found=""
+
+if [ -f "$terms_file" ]; then
+    while IFS= read -r term || [ -n "$term" ]; do
+        case "$term" in ''|\#*) continue ;; esac
+        lterm="$(printf '%s' "$term" | tr '[:upper:]' '[:lower:]')"
+        case "$lower" in
+            *"$lterm"*) found="$found
+  names a protected term: $term" ;;
+        esac
+    done < "$terms_file"
+fi
+
+# Built-in shapes, worth catching with no local list at all. Any noreply address is
+# excluded: git writes them into every trailer and they identify nobody.
+address="$(grep -oiE '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}' "$scan_input" \
+           | grep -viE '(^|[.+-])noreply@|@noreply\.' | head -1)"
+[ -n "$address" ] && found="$found
+  contains an email address: $address"
+
+if grep -qE '(gh[pousr]_[A-Za-z0-9]{16,}|sntrys_[A-Za-z0-9]{16,}|eyJ[A-Za-z0-9_-]{20,}\.)' "$scan_input"; then
+    found="$found
+  contains something shaped like a credential"
+fi
+
+if [ -n "$found" ]; then
+    printf 'Refused: this would publish something internal.%s\n' "$found"
+    printf '\nReword it, or add a deliberate exception to .git/leak-terms.txt\n'
+    exit 1
+fi
+exit 0

.githooks/leak-terms.example.txt

@@ -0,0 +1,14 @@
+# Copy this to .git/leak-terms.txt and fill in the real values.
+#
+# That destination is inside .git, so it is never committed. This example lives in the
+# repository only to document the format: a deny-list naming the things you are keeping
+# out of a public history must not itself be published, or it hands over the whole list.
+#
+# One literal term per line, matched case-insensitively anywhere in the text.
+# '#' starts a comment. Blank lines are ignored.
+
+# your-employer
+# your-customer
+# internal-hostname-fragment
+# -a-resource-naming-suffix
+# InternalServiceName

.githooks/pre-commit

@@ -0,0 +1,9 @@
+#!/bin/sh
+# Everything about to enter history, scanned first.
+#
+# Added lines only. A diff carries removals too, and scanning those would refuse the one
+# commit you most need to make: the one that takes a leaked term back out again.
+git diff --cached -U0 \
+    | grep '^+' \
+    | grep -v '^+++' \
+    | "$(git rev-parse --show-toplevel)/.githooks/leak-scan.sh" || exit 1

.github/workflows/leak-scan.yml

@@ -0,0 +1,54 @@
+name: leak-scan
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    name: No internal identifiers
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      # The literal deny-list cannot live in the repository, so CI carries it as a secret.
+      # Absent, the built-in shapes still apply; they need no list.
+      - name: Restore the deny-list
+        env:
+          LEAK_TERMS: ${{ secrets.LEAK_TERMS }}
+        run: |
+          if [ -n "$LEAK_TERMS" ]; then
+            echo "$LEAK_TERMS" > "$(git rev-parse --git-dir)/leak-terms.txt"
+            echo "deny-list restored"
+          else
+            echo "no LEAK_TERMS secret configured; built-in shapes only"
+          fi
+
+      - name: Scan the pushed commits
+        env:
+          BEFORE: ${{ github.event.before }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          chmod +x .githooks/leak-scan.sh
+
+          range="$HEAD_SHA~1..$HEAD_SHA"
+          if git rev-parse --verify --quiet "$BEFORE^{commit}" >/dev/null; then
+            range="$BEFORE..$HEAD_SHA"
+          fi
+          echo "Scanning $range"
+
+          failed=0
+          for c in $(git rev-list "$range"); do
+            if ! git log -1 --format='%B' "$c" | ./.githooks/leak-scan.sh; then
+              echo "::error::commit message of $c names something internal"
+              failed=1
+            fi
+            if ! git show "$c" -U0 --format= | grep '^+' | grep -v '^+++' | ./.githooks/leak-scan.sh; then
+              echo "::error::content added by $c names something internal"
+              failed=1
+            fi
+          done
+          exit $failed

README.md

@@ -136,6 +136,29 @@ a request the running app picks up. If Huginn is not running, it says so rather
 Set `HUGINN_PROFILE` to keep a second install's settings, credentials and snapshot separate from
 the first.
 
+## Keeping internal names out
+
+This repository is public, so nothing in it may name a customer, an employer or their
+infrastructure. Two checks enforce that rather than leaving it to care.
+
+Enable the hooks once per clone:
+
+```bash
+git config core.hooksPath .githooks
+```
+
+They refuse a commit whose **added lines or message** name a protected term, an email address
+or something shaped like a credential. Removals are ignored, so taking a leaked term back out
+is never blocked.
+
+The list of real names lives in `.git/leak-terms.txt`, which is inside `.git` and so is never
+committed; `.githooks/leak-terms.example.txt` documents the format. A deny-list naming the
+things you are keeping out of a public history must not itself be published.
+
+`.github/workflows/leak-scan.yml` runs the same script over every pushed commit, because a
+local hook is one `--no-verify` away from doing nothing. Give the repository a `LEAK_TERMS`
+secret to apply the literal list there too; without it the built-in shapes still apply.
+
 ## License
 
 [MIT](LICENSE)