• .env files
• API keys
• OAuth client secrets
• JWT signing keys
• private owner memory
• production database files
• raw user messages
• voice clone assets
• credentials from OpenAI, Anthropic, Gemini, Google, Apple, ElevenLabs, Stripe, Line, Telegram, Slack, Gmail, or other services

Run:

./scripts/scan_secrets.sh

Then manually check:

git status --short
git diff --cached

If you find a leaked secret, rotate it immediately. Do not open a public issue containing the secret value.