[shubham-s-pandey]

Summary

Adds Betterleaks-based secret scanning to detect credentials that may be accidentally committed to pull requests or repository history. This is an additive security control.

Security impact

A leaked GitHub, Cloudflare, or OAuth credential could allow unauthorized access to repositories or deployment resources. Detecting these values before merge reduces the time a credential can remain exposed and gives maintainers an actionable CI failure.

What this PR adds

• config/betterleaks.toml

  • Uses Betterleaks' built-in detectors.
  • Filters documented placeholders to reduce false positives.

• .github/workflows/betterleaks.yml

  • Runs on pull requests and pushes to main.
  • Scans complete Git history.
  • Uses the public Betterleaks container.
  • Requires no API key or repository secret.
  • Mounts the checkout read-only.
  • Grants only contents: read.

Safety design

Credential validation and analysis are intentionally disabled. The scanner
performs local detection only and does not send detected values to external
providers.

Validation

• The custom Betterleaks configuration parses successfully.
• The workflow explicitly loads config/betterleaks.toml.
• Full repository history is available to the scanner.
• No real credentials or secret-like test values are committed.