chore(security): use Gitleaks pre-commit hook

.pre-commit-config.yaml

@@ -0,0 +1,5 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.0
+    hooks:
+      - id: gitleaks

INSTALL.md

@@ -428,10 +428,20 @@ docker compose --profile enterprise-clean up --build
 
 ## Утилиты
 
+Для установки стандартного hook проверки секретов выполните из корня репозитория:
+
+```bash
+source backend/.venv/bin/activate
+python -m pip install -r backend/requirements-dev.txt
+pre-commit install
+```
+
+Pinned Gitleaks hook checks staged changes and redacts findings.
+
 | Скрипт | Назначение |
 |---|---|
 | `coverage-summary.sh` | Сводный отчёт покрытия |
-| `scan_secrets.sh` | Сканирование секретов |
+| `.pre-commit-config.yaml` | Проверка секретов в staged changes через Gitleaks |
 | `check_llm_certs.py` | Проверка SSL-сертификатов LLM |
 | `diag_container.py` | SSL-диагностика |
 | `find-related-tests.py` | Поиск тестов по изменённому файлу |

backend/requirements-dev.txt

@@ -7,3 +7,4 @@ pytest-timeout==2.4.0
 pytest-reportlog==1.0.0
 pytest-xdist==3.8.0
 watchfiles>=0.24
+pre-commit==4.7.0

docs/security-remediation.md

@@ -48,10 +48,12 @@ Everyone with old clones must re-clone or hard-reset to the rewritten history.
 
 ## Ongoing checks
 
-Run:
+Install the repository hook once:
 
 ```bash
-./scripts/scan_secrets.sh
+source backend/.venv/bin/activate
+python -m pip install -r backend/requirements-dev.txt
+pre-commit install
 ```
 
-before release and before pushing history-rewrite results.
+The pinned Gitleaks hook scans staged changes and redacts findings. It is a commit-time check; it does not scan prior Git history.

scripts/scan_secrets.sh

@@ -1,28 +0,0 @@
-#!/usr/bin/env bash
-# #region Tooling.ScanSecrets [C:1] [TYPE Module]
-# @PURPOSE: Utility script for scan_secrets
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "${ROOT_DIR}"
-
-echo "[scan] working tree patterns"
-rg -nI \
-  --glob '!frontend/node_modules/**' \
-  --glob '!.svelte-kit/**' \
-  --glob '!dist/**' \
-  --glob '!build/**' \
-  '(AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z\-_]{35}|sk_live_[0-9A-Za-z]{16,}|sk_test_[0-9A-Za-z]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9\-_]{20,}|hf_[A-Za-z0-9]{20,}|-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----|https?://[^/@[:space:]]+:[^@[:space:]]+@|ENCRYPTION_KEY[[:space:]]*=|AUTH_SECRET_KEY[[:space:]]*=)' \
-  | rg -v 'oauth2:(token|secret)@' || true
-
-echo "[scan] tracked env and database artifacts"
-git ls-files | rg '(^|/)\.env($|\.)|(^|/).*\.(db|sqlite|pem|p12|pfx|crt|key)$' || true
-
-echo "[scan] git history patterns"
-git grep -nIE \
-  '(AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|AIza[0-9A-Za-z\-_]{35}|sk_live_[0-9A-Za-z]{16,}|sk_test_[0-9A-Za-z]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9\-_]{20,}|hf_[A-Za-z0-9]{20,}|-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----|https?://[^/@[:space:]]+:[^@[:space:]]+@|ENCRYPTION_KEY[[:space:]]*=|AUTH_SECRET_KEY[[:space:]]*=)' \
-  $(git rev-list --all) \
-  | rg -v 'oauth2:(token|secret)@' || true
-
-# [/DEF:scan_secrets:Module]
-# #endregion Tooling.ScanSecrets