Issue #76 — Hard-Fail Secret Scanning (gitleaks/trufflehog) & Secret Rotation

[Topmatrixmor2014]

Replace the naive grep-based secret scan with a real secret scanner that hard-fails CI, and document a rotation runbook for any exposed secret.

Requirements and Context

.github/workflows/ci-validate.yml currently greps for sk-[a-zA-Z0-9]{32,} patterns, which misses most secret formats (Stellar keys, JWT secrets, DB URLs, AWS keys, private keys) and only emits a warning. A real secret scanner (gitleaks or trufflehog) with a hard-fail policy, plus a rotation runbook, is the correct control for a payments platform.

Objectives

1. Add a gitleaks (or trufflehog) CI job with a curated config and exit 1 on findings.
2. Add a pre-commit hook that runs the scanner on staged files.
3. Provide a baseline allowlist for known-safe test fixtures (and re-review them).
4. Write a docs/secret-rotation.md runbook for Stellar keys, JWT secrets, DB creds, and API keys.

Suggested Execution

1. git checkout -b feat/secret-scanning.
2. Add the scanner job to CI and the pre-commit config (.husky/).
3. Create .gitleaks.toml (or trufflehog config) and the runbook.
4. Run the scanner locally, fix/triage findings, and verify CI hard-fails on an injected test secret.

Acceptance Criteria

• CI hard-fails on any detected secret (≥1 injected-secret test proves it).
• Pre-commit hook blocks secret commits.
• A rotation runbook exists and covers all secret types in use.
• No live secrets remain in the repository history that the scanner flags.

Guidelines

• Use a pinned action/version for the scanner; keep the config in-repo.
• Treat test fixtures with an explicit allowlist path, not a global disable.

Timeframe: 72 hours

---

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.

[Theophilus131]

assign this to me. i can deliver a PR within 2 days

[midenotch]

Hi Maintainer,
Interested in working on this issue. I'll implement the requested changes and ensure everything is properly tested before submission.

Payout wallet (Stellar): GBLT6QSRPF7YGSCOWEOGBXKS2DRKOPBLF6QHJAD6QCNCWWQ54E2NJ4AB
GrantFox OSS campaign — smart escrow payout on merge.

[grantfox-oss]

🦊 GrantFox — @midenotch has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #645)
2. Your PR will be reviewed by the FinChippay maintainers

Good luck! Track your progress on GrantFox.