chore(security): add gitleaks secret detection and .gitignore security baseline (#493)

* chore(security): add gitleaks secret detection and .gitignore security baseline

Introduces gitleaks v8.30.1 for multi-layered secret scanning:
- pre-commit hook via .pre-commit-config.yaml
- CI job in security.yml with SHA256 checksum verification

Applies .gitignore security baseline template with
!extensions/*/.vscode/ negation for extension dev configs.

Also hardens all 8 checkout steps with persist-credentials: false.

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

* chore(security): add .gitleaks.toml to allowlist test fixtures and PEM header constants

Gitleaks correctly detects dummy API keys in test fixtures and PEM
header strings in sshAgent.ts, but these are intentional: test
fixtures use fake secrets for security testing, and sshAgent.ts
uses PEM headers as format detection constants (not actual keys).

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

* fix(ci): switch gitleaks to --no-git mode for working tree scan

Git history scanning triggers false positives on test fixture dummy
secrets and PEM header constants across past commits. Working tree
scan with .gitleaks.toml allowlist is sufficient — GitHub Secret
Scanning + Push Protection already covers history.

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

* fix(ci): correct .gitleaks.toml syntax and allowlist paths

Fix TOML syntax error (paths must be string array, not table array).
Add allowlist for compiled output (out/), .vscode-test/, and
node_modules/. Use regex alternation for src/out variants.

Signed-off-by: Null;Variant <null@nullvariant.com>

🖥️ IDE: [VS Code](https://code.visualstudio.com/)
🔌 Extension: [Claude Code](https://claude.ai/download)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Model-Raw: claude-opus-4-6

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: nullvariant

.github/workflows/security.yml

@@ -34,6 +34,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -77,6 +79,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -126,6 +130,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -163,6 +169,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
@@ -195,6 +203,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Run Semgrep
         uses: semgrep/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1 (v0.58.0, verified 2026-03-17)
@@ -204,6 +214,38 @@ jobs:
             p/security-audit
             p/secrets
 
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: "8.30.1"
+          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+        run: |
+          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            -o gitleaks.tar.gz
+          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
+          tar -xz -C /usr/local/bin gitleaks < gitleaks.tar.gz
+          rm gitleaks.tar.gz
+          gitleaks version
+
+      - name: Run gitleaks
+        run: gitleaks detect --source . --no-git --verbose
+
   socket-security:
     name: Socket.dev Security
     runs-on: ubuntu-latest
@@ -221,6 +263,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Socket Security Review
         uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2

.gitignore

@@ -1,35 +1,128 @@
-# Dependencies
-node_modules/
+# ============================================================
+# Security baseline (SSOT: _meta/_templates/infra/gitignore-security-baseline.md)
+# ============================================================
 
-# Build output
-out/
-dist/
+# --- Secret insurance (STD-00020 R3) ---
+**/.env
+**/.env.local
+**/.env.*.local
+**/.envrc
+**/.envrc.local
 
-# Coverage reports
-coverage/
+**/*.pem
+**/*.key
+**/*.p12
+**/*.pfx
+**/*.jks
+**/*.keystore
+**/*.gpg
 
-# VS Code extension packages
-*.vsix
+**/id_rsa
+**/id_rsa.*
+**/id_dsa
+**/id_ecdsa
+**/id_ecdsa.*
+**/id_ed25519
+**/id_ed25519.*
 
-# VS Code test downloads
-.vscode-test/
+**/credentials
+**/credentials.json
+**/credentials.yaml
+**/credentials.yml
+**/*.credentials.json
+**/.git-credentials
+**/.netrc
+**/.npmrc
+**/.pgpass
+**/.htpasswd
+**/.vault_pass
+**/vault_pass.txt
+
+**/service_account*.json
+**/*-service-account*.json
+**/firebase-adminsdk*.json
+**/gcp-credentials*.json
+**/aws-credentials*.json
+**/client_secret*.json
+
+**/secret.yaml
+**/secret.yml
+**/secrets.yaml
+**/secrets.yml
+**/private.asc
+**/privkey.asc
+**/secret.asc
+
+**/.aws/config
+**/.config/gcloud/application_default_credentials.json
+**/.config/gcloud/credentials.db
+**/.credentials/
+**/sensitive/
+**/kubeconfig
+**/*.kubeconfig
+
+# --- OS generated files ---
+**/.DS_Store
+**/.DS_Store?
+**/._*
+**/.Spotlight-V100
+**/.Trashes
+**/Thumbs.db
+**/ehthumbs.db
+**/Desktop.ini
 
-# TypeScript cache
-*.tsbuildinfo
+# --- Editor / IDE ---
+**/.vscode/
+**/.idea/
+**/*.swp
+**/*.swo
+**/*~
+**/.project
+**/.classpath
+**/.settings/
 
-# ESLint cache
-.eslintcache
+# --- Node.js / TypeScript ---
+**/node_modules/
+**/.npm/
+**/*.tsbuildinfo
+**/.eslintcache
 
-# OS files
-.DS_Store
+# --- Python ---
+**/__pycache__/
+**/*.py[cod]
+**/*$py.class
+**/*.egg-info/
+**/.mypy_cache/
+**/.ruff_cache/
+**/.pytest_cache/
+**/venv/
+**/.venv/
 
-# IDE
-.idea/
+# --- Build output / coverage ---
+**/dist/
+**/coverage/
+**/.nyc_output/
 
-# Logs
-*.log
-npm-debug.log*
+# --- Logs / temp files ---
+**/*.log
+**/npm-debug.log*
+**/yarn-debug.log*
+**/yarn-error.log*
+**/*.tmp
+**/*.temp
 
-# Environment
-.env
-.env.local
+# ============================================================
+# Project-specific exclusions (add below)
+# ============================================================
+
+# VS Code workspace configs (intentionally tracked for extension development)
+!extensions/*/.vscode/
+
+# Build output
+out/
+
+# VS Code extension packages
+*.vsix
+
+# VS Code test downloads
+.vscode-test/

.gitleaks.toml

@@ -0,0 +1,10 @@
+[extend]
+useDefault = true
+
+[allowlist]
+paths = [
+  '''(src|out)/test/''',
+  '''(src|out)/ssh/sshAgent\.(ts|js)''',
+  '''\.vscode-test/''',
+  '''node_modules/''',
+]

.pre-commit-config.yaml

@@ -26,3 +26,9 @@ repos:
         args: ['--maxkb=1000']
       - id: mixed-line-ending
         args: ['--fix=lf']
+
+  # Secret detection
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks

README.md

@@ -12,6 +12,7 @@
 [![Snyk monitored](https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white)](https://snyk.io/)
 [![Socket.dev](https://img.shields.io/badge/Socket.dev-monitored-7042F5)](https://socket.dev/dashboard/org/null-variant/repo/nullvariant-vscode-extensions)
 [![GitGuardian](https://img.shields.io/badge/GitGuardian-monitored-7042F5?logo=gitguardian)](https://www.gitguardian.com/)
+[![Gitleaks](https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white)](https://github.com/gitleaks/gitleaks)
 [![Renovate](https://img.shields.io/badge/renovate-enabled-brightgreen?logo=renovatebot)](https://renovatebot.com)
 [![FOSSA License](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions.svg?type=shield&issueType=license)](https://app.fossa.com/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions?ref=badge_shield&issueType=license)
 [![FOSSA Security](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions.svg?type=shield&issueType=security)](https://app.fossa.com/projects/git%2Bgithub.com%2Fnullvariant%2Fnullvariant-vscode-extensions?ref=badge_shield&issueType=security)

SECURITY.md

@@ -67,6 +67,7 @@ This repository contains VS Code extensions with the following security measures
 - **Fork Protection**: Sensitive workflows skip on fork repositories
 - **SAST (Snyk Code)**: [Snyk](https://snyk.io/) runs static analysis; test fixtures are excluded via `.snyk` policy
 - **License & Vulnerability Scanning**: [FOSSA](https://app.fossa.com/) runs license compliance, dependency quality, and security analysis on every commit (GitHub App integration)
+- **Secret Detection**: [Gitleaks](https://github.com/gitleaks/gitleaks) scans for hardcoded secrets in both CI (`security.yml`) and pre-commit hooks (`.pre-commit-config.yaml`)
 - **Runtime Security Monitoring**: [StepSecurity Harden-Runner](https://github.com/step-security/harden-runner) monitors all workflow runs for suspicious network egress, file access, and process execution
 - **Branch Protection**: Main branch requires PR approval (1 reviewer minimum). All PRs are automatically approved by nullvariant-justice[bot] after CI passes (solo-developer workflow for [OpenSSF Scorecard](https://securityscorecards.dev/) compliance). Dependency bot PRs receive additional safety review before approval. Enforced by [Allstar](https://github.com/ossf/allstar/)
 

extensions/git-id-switcher/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.19.5] - 2026-05-09
+
+### Added
+
+- **Gitleaks secret detection**: Added gitleaks v8.30.1 for multi-layered secret scanning via pre-commit hook and CI job with SHA256 checksum verification
+- **Gitleaks badge**: Added Gitleaks badge to the root README, extension README, and all 26 localized READMEs
+
+### Changed
+
+- **.gitignore security baseline**: Rewrote .gitignore with comprehensive secret insurance patterns (`**/` prefix, credential files, key files) and project-specific negation for extension `.vscode/` dev configs
+- **Workflow hardening**: Added `persist-credentials: false` to all 8 checkout steps in `security.yml`
+
 ## [0.19.4] - 2026-04-16
 
 ### Removed

extensions/git-id-switcher/README.md

@@ -25,6 +25,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="https://github.com/nullvariant/nullvariant-vscode-extensions/blob/main/extensions/git-id-switcher/docs/DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>

extensions/git-id-switcher/docs/i18n/ain/README.md

@@ -43,6 +43,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="../../DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>

extensions/git-id-switcher/docs/i18n/bg/README.md

@@ -21,6 +21,7 @@
       <a href="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions"><img src="https://codecov.io/gh/nullvariant/nullvariant-vscode-extensions/graph/badge.svg" alt="codecov"></a>
       <a href="https://sonarcloud.io/summary/new_code?id=nullvariant_nullvariant-vscode-extensions"><img src="https://sonarcloud.io/api/project_badges/measure?project=nullvariant_nullvariant-vscode-extensions&metric=alert_status" alt="Quality Gate Status"></a>
       <a href="https://snyk.io/"><img src="https://img.shields.io/badge/Snyk-monitored-4C4A73?logo=snyk&logoColor=white" alt="Snyk monitored"></a>
+      <a href="https://github.com/gitleaks/gitleaks"><img src="https://img.shields.io/badge/Gitleaks-enabled-blue?logo=git&logoColor=white" alt="Gitleaks"></a>
       <a href="https://github.com/step-security/harden-runner"><img src="https://img.shields.io/badge/Harden--Runner-enabled-7037F5" alt="Harden-Runner"></a>
       <a href="../../DESIGN_PHILOSOPHY.md"><img src="https://img.shields.io/badge/🪨_Karesansui-Architecture-4a5568" alt="Karesansui Architecture"></a>
       <br>