chore(security): add gitleaks secret detection and .gitignore security baseline

Introduces gitleaks v8.30.1 for multi-layered secret scanning:
- pre-commit hook via .pre-commit-config.yaml
- CI job in security.yml with SHA256 checksum verification

Applies .gitignore security baseline template with
!extensions/*/.vscode/ negation for extension dev configs.

Also hardens all 8 checkout steps with persist-credentials: false.

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

Author: nullvariant

.github/workflows/security.yml

@@ -34,6 +34,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -77,6 +79,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -126,6 +130,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -163,6 +169,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
@@ -195,6 +203,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Run Semgrep
         uses: semgrep/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1 (v0.58.0, verified 2026-03-17)
@@ -204,6 +214,39 @@ jobs:
             p/security-audit
             p/secrets
 
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            -o gitleaks.tar.gz
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar -xz -C /usr/local/bin gitleaks < gitleaks.tar.gz
+          rm gitleaks.tar.gz
+          gitleaks version
+
+      - name: Run gitleaks
+        run: gitleaks detect --source . --verbose
+
   socket-security:
     name: Socket.dev Security
     runs-on: ubuntu-latest
@@ -221,6 +264,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Socket Security Review
         uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2

.gitignore

@@ -1,35 +1,128 @@
-# Dependencies
-node_modules/
+# ============================================================
+# Security baseline (SSOT: _meta/_templates/infra/gitignore-security-baseline.md)
+# ============================================================
 
-# Build output
-out/
-dist/
+# --- Secret insurance (STD-00020 R3) ---
+**/.env
+**/.env.local
+**/.env.*.local
+**/.envrc
+**/.envrc.local
 
-# Coverage reports
-coverage/
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/*.jks
+**/*.keystore
+**/*.gpg
 
-# VS Code extension packages
-*.vsix
+**/id_rsa
+**/id_rsa.*
+**/id_dsa
+**/id_ecdsa
+**/id_ecdsa.*
+**/id_ed25519
+**/id_ed25519.*
 
-# VS Code test downloads
-.vscode-test/
+**/credentials
+**/credentials.json
+**/credentials.yaml
+**/credentials.yml
+**/*.credentials.json
+**/.git-credentials
+**/.netrc
+**/.npmrc
+**/.pgpass
+**/.htpasswd
+**/.vault_pass
+**/vault_pass.txt
+
+**/service_account*.json
+**/*-service-account*.json
+**/firebase-adminsdk*.json
+**/gcp-credentials*.json
+**/aws-credentials*.json
+**/client_secret*.json
+
+**/secret.yaml
+**/secret.yml
+**/secrets.yaml
+**/secrets.yml
+**/private.asc
+**/privkey.asc
+**/secret.asc
+
+**/.aws/config
+**/.config/gcloud/application_default_credentials.json
+**/.config/gcloud/credentials.db
+**/.credentials/
+**/sensitive/
+**/kubeconfig
+**/*.kubeconfig
+
+# --- OS generated files ---
+**/.DS_Store
+**/.DS_Store?
+**/._*
+**/.Spotlight-V100
+**/.Trashes
+**/Thumbs.db
+**/ehthumbs.db
+**/Desktop.ini
 
-# TypeScript cache
-*.tsbuildinfo
+# --- Editor / IDE ---
+**/.vscode/
+**/.idea/
+**/*.swp
+**/*.swo
+**/*~
+**/.project
+**/.classpath
+**/.settings/
 
-# ESLint cache
-.eslintcache
+# --- Node.js / TypeScript ---
+**/node_modules/
+**/.npm/
+**/*.tsbuildinfo
+**/.eslintcache
 
-# OS files
-.DS_Store
+# --- Python ---
+**/__pycache__/
+**/*.py[cod]
+**/*$py.class
+**/*.egg-info/
+**/.mypy_cache/
+**/.ruff_cache/
+**/.pytest_cache/
+**/venv/
+**/.venv/
 
-# IDE
-.idea/
+# --- Build output / coverage ---
+**/dist/
+**/coverage/
+**/.nyc_output/
 
-# Logs
-*.log
-npm-debug.log*
+# --- Logs / temp files ---
+**/*.log
+**/npm-debug.log*
+**/yarn-debug.log*
+**/yarn-error.log*
+**/*.tmp
+**/*.temp
 
-# Environment
-.env
-.env.local
+# ============================================================
+# Project-specific exclusions (add below)
+# ============================================================
+
+# VS Code workspace configs (intentionally tracked for extension development)
+!extensions/*/.vscode/
+
+# Build output
+out/
+
+# VS Code extension packages
+*.vsix
+
+# VS Code test downloads
+.vscode-test/

.pre-commit-config.yaml

@@ -26,3 +26,9 @@ repos:
         args: ['--maxkb=1000']
       - id: mixed-line-ending
         args: ['--fix=lf']
+
+  # Secret detection
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks

README.md

@@ -12,6 +12,7 @@
 [![Snyk monitored](https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white)](https://snyk.io/)
 [![Socket.dev](https://img.shields.io/badge/Socket.dev-monitored-7042F5)](https://socket.dev/dashboard/org/null-variant/repo/nullvariant-vscode-extensions)
 [![GitGuardian](https://img.shields.io/badge/GitGuardian-monitored-7042F5?logo=gitguardian)](https://www.gitguardian.com/)
+[![Gitleaks](https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white)](https://github.com/gitleaks/gitleaks)
 [![Renovate](https://img.shields.io/badge/renovate-enabled-brightgreen?logo=renovatebot)](https://renovatebot.com)
 [![FOSSA License](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions.svg?type=shield&issueType=license)](https://app.fossa.com/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions?ref=badge_shield&issueType=license)
 [![FOSSA Security](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions.svg?type=shield&issueType=security)](https://app.fossa.com/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions?ref=badge_shield&issueType=security)

SECURITY.md

@@ -67,6 +67,7 @@ This repository contains VS Code extensions with the following security measures
 - **Fork Protection**: Sensitive workflows skip on fork repositories
 - **SAST (Snyk Code)**: [Snyk](https://snyk.io/) runs static analysis; test fixtures are excluded via `.snyk` policy
 - **License & Vulnerability Scanning**: [FOSSA](https://app.fossa.com/) runs license compliance, dependency quality, and security analysis on every commit (GitHub App integration)
+- **Secret Detection**: [Gitleaks](https://github.com/gitleaks/gitleaks) scans for hardcoded secrets in both CI (`security.yml`) and pre-commit hooks (`.pre-commit-config.yaml`)
 - **Runtime Security Monitoring**: [StepSecurity Harden-Runner](https://github.com/step-security/harden-runner) monitors all workflow runs for suspicious network egress, file access, and process execution
 - **Branch Protection**: Main branch requires PR approval (1 reviewer minimum). All PRs are automatically approved by nullvariant-justice[bot] after CI passes (solo-developer workflow for [OpenSSF Scorecard](https://securityscorecards.dev/) compliance). Dependency bot PRs receive additional safety review before approval. Enforced by [Allstar](https://github.com/ossf/allstar/)
 

extensions/git-id-switcher/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.5] - 2026-05-09
+
+### Added
+
+- **Gitleaks secret detection**: Added gitleaks v8.30.1 for multi-layered secret scanning via pre-commit hook and CI job with SHA256 checksum verification
+- **Gitleaks badge**: Added Gitleaks badge to the root README, extension README, and all 26 localized READMEs
+
+### Changed
+
+- **.gitignore security baseline**: Rewrote .gitignore with comprehensive secret insurance patterns (`**/` prefix, credential files, key files) and project-specific negation for extension `.vscode/` dev configs
+- **Workflow hardening**: Added `persist-credentials: false` to all 8 checkout steps in `security.yml`
+
 ## [0.19.4] - 2026-04-16
 
 ### Removed

extensions/git-id-switcher/README.md

@@ -25,6 +25,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>

extensions/git-id-switcher/docs/i18n/ain/README.md

@@ -43,6 +43,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="../../DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>

extensions/git-id-switcher/docs/i18n/bg/README.md

@@ -21,6 +21,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="../../DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>

extensions/git-id-switcher/docs/i18n/cs/README.md

@@ -21,6 +21,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="../../DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>