'gitleaks protect' is the deprecated alias. Both work today, but the
deprecated form will eventually be removed and the failure mode is a
silently non-functioning secret gate — worse than no gate, because it
is trusted.
Verified end-to-end: staging a file containing a Supabase service-role
JWT and a GitHub PAT causes the pre-commit hook to exit 1 and block the
commit.
Refs C-03
Layout, secret hygiene and workflow per the engagement's version control
plan. Nothing functional yet — this establishes the shape before code
lands, so the conventions are enforced from the first real commit.
- .gitignore + .env.example: no secret can reach a commit object
- lefthook + gitleaks pre-commit gate; blocks new files >10MB
- templates/ holds config files, never per-template scripts
- deploy/nginx/ version controlled rather than hand-edited on the server
Refs ADR-007
