diff --git a/.familyops/audit-signing-key.pem b/.familyops/audit-signing-key.pem
deleted file mode 100644
index 8e3b04e..0000000
--- a/.familyops/audit-signing-key.pem
+++ /dev/null
@@ -1,3 +0,0 @@
------BEGIN PRIVATE KEY-----
-MC4CAQAwBQYDK2VwBCIEIDwORWVe26n9Li7wjeut4aYn0SjqhXVE/GU3iS0qamKJ
------END PRIVATE KEY-----
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2f0c890..af6206f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,6 +5,11 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    ignore:
+      # Types must describe the oldest supported runtime (Node 22, see
+      # package.json engines), or code can compile against APIs it lacks.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
     # Supply-chain guard: only propose releases that are at least a week old.
     # Security updates are not delayed by cooldown.
     cooldown:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70d92d4..5a4639c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -39,6 +39,18 @@ jobs:
         run: npm audit --audit-level=high
       - run: make ci
 
+  # Every push is scanned for secrets across full history, so a key committed
+  # by mistake fails CI instead of relying on someone running the scan by hand.
+  secrets:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: gitleaks
+        run: docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 git /repo --redact --exit-code 1
+
   # Passive scan of the app in its production shape: the API serving the built
   # web app under its real headers and CSP, with demo features switched off.
   zap:
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 0000000..9643df8
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,5 @@
+# A locally generated demo audit-signing key was committed by mistake in the
+# rename (6e0ad21, 2026-09-28). It signed only local demo checkpoints, was
+# rotated the same day and removed from the tree; history was not rewritten.
+6e0ad21c2dbff9ac5c374ef05a359a3a9a0ccbdd:.familyops/audit-signing-key.pem:private-key:1
+bde7d58f7edeee5b050610ba191d7bee91a1f925:.familyops/audit-signing-key.pem:private-key:1