# Security & privacy notes

This repo is published. Before the first commit — and before every push — a
scrub pass was/was run:

## What was redacted or excluded

- Real Linux username in any path → `$HOME` / `~` / placeholders
- Hostname, machine-id, MAC/serial numbers → stripped from audit docs
- SSH private keys, authorized_keys, known_hosts → never vendored; backups only
- API tokens (Jan LLM env block found in `.zshenv`, git credentials, etc.) →
  never copied into this repo; they exist only on the machine and in backups
- Personal wallpapers/photos → not included; themes ship upstream artwork only
- `~/.aws`, `~/.config/gh`, docker logins, `.netrc` → never swept into repo

## What a new user must supply themselves

Nothing is required for the desktop to work. Optional integrations you may add
on your own machine (never commit them):

- any tokens your own scripts need → put them in
  `~/.config/de-omarchy/secrets.env` (gitignored pattern below) and source it
  from your shell rc

## Tooling

- `scripts/scan-secrets.sh` runs gitleaks (if installed) plus targeted greps
  for keys, tokens, bearer headers, hardcoded `/home/<user>` paths.
- Run it before **every** commit/push: `./scripts/scan-secrets.sh`
- If a real secret ever lands in history: rotate the credential immediately,
  then rewrite history (`git filter-repo`) or start a fresh repo — removing it
  in a later commit does NOT remove it from history.

## Backups are radioactive by design

`~/.de-omarchy-backups/` contains full copies of real dotfiles including
secrets. It lives outside this repo, must never be committed, and should sit on
an encrypted or physically secure volume.