feat: add verifiable checkpoint provenance #246
secret-guard.yml
on: push
Scan for leaked secrets & PII
16s
Scan for internal infrastructure leaks
7s
Scan for suspicious filenames
4s