# The last commit whose ENTIRE history was scanned for credentials and came back
# clean. History is immutable, so everything reachable from this commit never
# needs scanning again — only what has been added since.
#
# Read by tools/secret-scan/gitleaks-scan.sh, which `make scan-secrets`, the pre-commit hook
# and .github/workflows/secrets.yml all go through. An incremental scan is
# `--all --not <commit>`: every commit on every ref that this one does not already
# cover. That is also the net for anything a per-pull-request range scan could not
# reach — within the limit that it can only read refs that still exist.
#
# Re-baseline — run `make scan-secrets-full`, then move `commit` to the scanned
# HEAD and update the other fields — when any of these change, because each of
# them can surface something the recorded run could not:
#
#   - the gitleaks version (new or corrected detection rules)
#   - .gitleaks.toml (a rule added, or an allowlist narrowed)
#   - .gitleaksignore (a fingerprint removed or changed — the finding it used to
#     dismiss sits behind the watermark, so no incremental scan will raise it again)
#   - the git log options the scan uses (the merge-commit gap fixed on 2026-09-07
#     is exactly this case: every scan before it read no merge patches at all)
#
# The version is enforced: an incremental scan refuses to run when the installed
# gitleaks is not the one recorded here. The other three are on the maintainer.
#
# Rewriting history (git filter-repo) invalidates this file outright: every SHA
# after the rewrite point is new, so the recorded commit no longer exists.
# Reset 2026-09-07: the previous watermark named a commit that the day's history
# rewrites removed, so the incremental scan had no valid base and every run fell
# back to a full sweep. This is a full-history clean result on the rewritten
# history — 1135 commits, 858 MB, five findings, all dismissed in .gitleaksignore.
# Refreshed 2026-09-12: the #5 refresh dropped the `gitleaks=` line, so every
# incremental scan since failed the version check before scanning anything.
# Full-history rescan, 1328 commits, 977 MB, no leaks. The watermark is main's
# tip rather than the branch head that ran the scan — a squash-merged branch's
# commits vanish with the branch, and a watermark must stay resolvable.
# Refreshed 2026-09-24: .gitleaks.toml gained the personal-email rule. Full-history
# rescan, 1706 commits, 1.05 GB; its 13 historical findings were reviewed and
# dismissed in .gitleaksignore. Watermark = main's tip at scan time.
commit=9b06586c887f3ef43192a103dec3a597e0437a5d
date=2026-09-24
gitleaks=8.30.1
