windyboy f77a4afd50 security: widen verifier (openssh/hyphenated-sk/ctx7sk/credential-assign/telegram/conn-string), fix GIT_WORKFLOW guidance ...

- BEGIN [A-Z0-9 ]*PRIVATE KEY now covers OPENSSH/RSA/EC variants
- sk- patterns tolerate hyphens and prefixed families (ctx7sk-)
- credential-assign catches PASSWORD=/token:/|API_KEY| tables (placeholder-aware)
- telegram bot tokens + connection strings with embedded passwords
- .obsidian/** third-party plugin code excluded from value scan (noise)
- regression: all 12 files named in REVIEW-FOLLOWUP now flagged
- GIT_WORKFLOW: drop git add . / Windows path, add verifier step,
  note force-push exception for the one-time history rewrite

2026-09-26 12:09:11 +08:00

..

Reference

security: widen verifier (openssh/hyphenated-sk/ctx7sk/credential-assign/telegram/conn-string), fix GIT_WORKFLOW guidance

2026-09-26 12:09:11 +08:00

Templates

refactor(vault): Phase 4 — 06_Metadata slimming 42 → 8

2026-09-26 11:38:51 +08:00

SECURITY_ROTATION_LOG_2026-02.md

vault backup: 2026-02-25 16:53:37

2026-02-25 16:53:37 +08:00