public-surface-audit

To detect private tokens in tracked files before publishing, scan your git-tracked public file sets for operator-specific data like real usernames, company assets, or absolute home paths. This pre-publish validation ensures your public repository remains free of confidential operator data.

Gitignore validation prevents sensitive data leaks by proactively catching files that should be private but are not actually ignored by git. This safeguard stops future accidental commits of confidential operator data by enforcing proper public and private repository splits.

Yes, you can use token leak detection to gate CI hooks for public repository validation. The audit provides machine-parseable JSON output specifically designed for automated CI/CD pre-push or pre-publish hook gating to enforce the invariant that public repositories contain no operator-specific confidential data.

Yes, pre-publish scanning deliberately excludes gitignored private files like CLAUDE.local.md to avoid false positives. The tracked-file-only scanning focuses exclusively on the public surface that will be shared, ensuring private local configurations do not trigger unnecessary leak alerts.

The best way to audit a public and private repository split is to run a public surface audit that applies configurable severity-classified pattern matching to tracked files. It flags high-severity leaks, medium-severity identity issues, and low-severity drift with clear file and line reporting.

Placeholder text triggers false positives during a token leak scan because pattern matching may detect formatting that resembles real operator data. The audit implements placeholder false positive hygiene and tight allowlist suppression to filter these out and maintain accurate leak detection.