feat(security): add gitleaks secret scan to lefthook pre-commit

.lefthook/pre-commit/secret-scan.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+# Secret scan — called by lefthook pre-commit hook.
+# Scans staged files with gitleaks to block secrets from being committed.
+# Skipped during merge/rebase (configured in lefthook.yml).
+
+set -euo pipefail
+
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "ERROR: gitleaks is not installed." >&2
+  echo "  Install it via mise, brew, or download from https://github.com/gitleaks/gitleaks" >&2
+  echo "  Override with git commit --no-verify if needed." >&2
+  exit 1
+fi
+
+gitleaks protect --staged --verbose

README.md

@@ -26,15 +26,17 @@ A starter template for new GitHub repositories.
 This template includes `lefthook.yml` for git hook management.
 
 ```bash
-# Install lefthook (via mise or your package manager)
+# Install lefthook and gitleaks (via mise or your package manager)
 mise use lefthook
+mise use gitleaks
 
 # Install hooks into .git/hooks/
 lefthook install
 ```
 
 Hooks configured:
 - **pre-commit**: runs `npm run lint` if package.json exists (skips merge/rebase)
+- **pre-commit**: scans staged files with gitleaks to block secrets (skips merge/rebase)
 - **commit-msg**: enforces `type(scope): summary` commit message format via `.lefthook/commit-msg/commit-msg-lint.sh`
 
 Scripts live under `.lefthook/<hook-name>/`. Override with `git commit --no-verify` when needed.

lefthook.yml

@@ -6,6 +6,11 @@
 
 pre-commit:
   commands:
+    secret-scan:
+      run: bash .lefthook/pre-commit/secret-scan.sh
+      skip:
+        - merge
+        - rebase
     lint:
       run: |
         # Run project lint if available