# Git Safety

Git safety is mandatory before every commit.

## What must never be committed

- Health or Finance productive SQLite databases
- CSV/XLS/XLSX imports or exports
- PDFs
- generated reports
- `.gpg` backup bundles
- OAuth files
- credential JSON files
- `.env` files with real values
- tokens, passwords, passphrases, API keys
- runtime directories or logs

## Required pre-commit checks

From repository root:

```bash
# 1. show changed files
git status --short

# 2. forbidden file types
find . -type f \
  \( -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' -o -name '*.csv' -o -name '*.xlsx' -o -name '*.pdf' -o -name '*.gpg' -o -name 'credentials.json' \) \
  -not -path './.git/*' -print

# 3. obvious secret patterns, excluding the canonical denylist docs if needed
grep -RInE 'github_pat_|ghp_|GITHUB_TOKEN|OPENAI_API_KEY|ANTHROPIC_API_KEY|refresh_token|access_token|api_key[=:]|secret[=:]|password[=:]|passphrase[=:]' . \
  --exclude-dir=.git

# 4. inspect staged diff
git diff --cached --stat
git diff --cached
```

The final implementation should turn these into scripts/CI checks. Phase 2A documents the rule; it does not add tooling yet.

## Redaction scan expectation

Future CI should also validate that `docs/contracts/examples/*.json` do not contain forbidden fields from `docs/security/forbidden-fields.md`.

## If a forbidden file is found

Do not commit. Remove the file from the worktree or `.gitignore` it before staging. If already staged:

```bash
git restore --staged <path>
```

If already committed locally, stop and repair history before pushing.