- `bin/setup` installs gitleaks - add `gitleaks dir` command to CI - configure gitleaks to ignore tmp, log, and encrypted files - tag existing false positives with `gitleaks:allow` - add historical false positives to the ignore list