Secret scanning in CI; rotate leaked demo key; hold @types/node

.github/dependabot.yml

@@ -5,6 +5,11 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    ignore:
+      # Types must describe the oldest supported runtime (Node 22, see
+      # package.json engines), or code can compile against APIs it lacks.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
     # Supply-chain guard: only propose releases that are at least a week old.
     # Security updates are not delayed by cooldown.
     cooldown:

.github/workflows/ci.yml

@@ -39,6 +39,18 @@ jobs:
         run: npm audit --audit-level=high
       - run: make ci
 
+  # Every push is scanned for secrets across full history, so a key committed
+  # by mistake fails CI instead of relying on someone running the scan by hand.
+  secrets:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: gitleaks
+        run: docker run --rm -v "$PWD:/repo" ghcr.io/gitleaks/gitleaks:v8.30.1 git /repo --redact --exit-code 1
+
   # Passive scan of the app in its production shape: the API serving the built
   # web app under its real headers and CSP, with demo features switched off.
   zap:

.gitleaksignore

@@ -0,0 +1,5 @@
+# A locally generated demo audit-signing key was committed by mistake in the
+# rename (6e0ad21, 2026-09-28). It signed only local demo checkpoints, was
+# rotated the same day and removed from the tree; history was not rewritten.
+6e0ad21c2dbff9ac5c374ef05a359a3a9a0ccbdd:.familyops/audit-signing-key.pem:private-key:1
+bde7d58f7edeee5b050610ba191d7bee91a1f925:.familyops/audit-signing-key.pem:private-key:1